{"id":"CVE-2026-107276","published":"2026-10-07T16:17:47.213","lastModified":"2026-10-07T21:17:14.903","description":"MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: <2.5.48","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-362","CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://github.com/MISP/MISP/commit/ba95e67d5","tags":[]}],"exploitRefs":[{"url":"https://github.com/MISP/MISP/commit/ba95e67d5","tags":[]}],"hasPoc":true,"ai":null}