TOTP Verification Bypass in MISP's UsersController by MISP
CVE-2026-95754

6.9MEDIUM

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
22 September 2026

What is CVE-2026-95754?

The vulnerability in MISP's UsersController's login() method arises from a pre-authentication database query that neglects to include the User.disabled column. Consequently, a disabled user enrolled with TOTP can inadvertently progress to the TOTP verification step, rather than being immediately rejected. Although the potential security impact is minimal due to a subsequent validation check that rejects the disabled account, it does allow for an unnecessary TOTP prompt and generates a PHP warning regarding an undefined array key in the application logs.

Affected Version(s)

MISP 0 < 2.5.47

References

https://github.com/MISP/MISP/commit/3df982ab1
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iglocska
Claude Fable 5.1
.