Race Condition in Email OTP Login for MISP by Risk Management Solutions

CVE-2026-107276

What is CVE-2026-107276?

MISP exhibits a race condition vulnerability in its email-based one-time password (OTP) authentication system. This flaw allows an attacker with a valid OTP to authenticate multiple times by sending concurrent HTTP requests. The vulnerability arises from the fact that the OTP is processed in non-atomic operations, leading to both requests successfully establishing authenticated sessions before the first request’s OTP is deleted. This could result in unauthorized access to sensitive information and compromised account security if an OTP is intercepted or shared.

References