Brute Force Vulnerability in MISP's Email OTP System by MISP

CVE-2026-85237

What is CVE-2026-85237?

A flaw in MISP's email-based one-time password (OTP) authentication flow enables attackers to execute an unlimited number of OTP verification attempts. This occurs due to the absence of brute-force protection in the email_otp() endpoint, allowing multiple submissions of the same OTP while it remains valid. An attacker, upon successfully providing a user's primary authentication credentials, can repeatedly guess the valid OTP, thus increasing the risk of unauthorized account access. The vulnerability is worsened by the OTP being tied to the user rather than the individual session, allowing simultaneous guesses for the same OTP across multiple sessions. The recent patch implements robust brute-force protection measures, limiting failed attempts and invalidating the OTP when thresholds are exceeded.

References