CVE-2026-92003

Summary

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Two API authentication failure branches wrote directly to the Log model:

 - API requests with no authentication key;  - requests supplying an API key with an incorrect length

Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.

Version affected: ≤2.5.45

Affected Software

Weaknesses

• CWE-770: CWE-770 Allocation of Resources Without Limits or Throttling
• CWE-400: CWE-400 Uncontrolled Resource Consumption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/MISP/MISP/commit/2bf887433

• ←Previous
• Next→