OIDC Authentication Plugin Vulnerability in MISP by The MISP Project

CVE-2026-9084

What is CVE-2026-9084?

The OIDC authentication plugin for MISP has a critical flaw that permits the automatic linking of an OIDC identity to a local user account when no sub value is recorded. This vulnerability arises under potentially insecure or untrusted identity provider (IdP) configurations, where email ownership validation is absent. An attacker holding a legitimate OIDC token could exploit this weakness to impersonate a victim by asserting their email address, leading to unauthorized account access and compromising user security.

References