Insufficient HTTP Method Validation in MISP's UsersController.php

CVE-2026-94379

What is CVE-2026-94379?

A security flaw in MISP's login functionality allows unauthenticated attackers to bypass crucial security mechanisms like brute-force protection and multi-factor authentication by exploiting insufficient validation of HTTP methods. Attackers can use non-POST/PUT requests to bypass checks that normally limit login attempts and log failures, leading to potential credential compromise and unauthorized access to the system. This vulnerability notably affects versions of MISP prior to 2.5.47.

References