Authentication Bypass in MISP with LDAP Mixed Authentication and OTP Enforcement

CVE-2026-10611

What is CVE-2026-10611?

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled alongside OTP enforcement. This issue occurs in configurations where the LdapAuth.mixedAuth option is set to true and the Security.require_otp setting is enforced. In such cases, users authenticating via an LDAP plugin can establish a session without completing the required OTP challenge, allowing unauthorized access to the application. When validated credentials are used, an attacker may exploit this flaw to bypass the OTP verification step and gain entry to the application as the authenticated user. The vulnerability can be mitigated by ensuring OTP requirements are checked immediately post-authentication, preventing session establishment without valid OTP verification.

References