What’s Vulnerable › Vulnerabilities
CVE-2026-107276: MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
- Severity: medium (CVSS 6.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-07 · updated 2026-10-07
- Weakness: CWE-362
Description
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: - The target MISP instance has email OTP login enabled. - The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering). - The attacker can issue two HTTP POST requests in close temporal proximity. Impact: - The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. - This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48
Affected products
- MISP: before 2.5.48 — fixed in 2.5.48
How to fix
Upgrade to a fixed version: MISP 2.5.48. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-107276 or the next vulnerability affects your stack