Two-Factor Authentication Bypass in MISP Instances by MISP

CVE-2026-107180

What is CVE-2026-107180?

An authentication bypass vulnerability exists in MISP instances where TOTP enrolment is required. Users who have not completed TOTP setup can exploit this flaw to bypass mandatory two-factor authentication by executing non-browser requests, such as AJAX calls or REST API actions. This oversight enables them to maintain full access to the MISP instance without being prompted to enroll in two-factor authentication, undermining the intended security protocols. Once identified, the initial fix addressed AJAX requests, followed by an enhancement to cover all non-browser request types while preserving API key exemptions.

References