CVE-2026-85237

MISP's email-based one-time password (OTP) authentication flow lacked brute-force protection: the email_otp() endpoint accepted an unrestricted number of OTP verification attempts while the same OTP remained valid. An attacker who has already supplied a user's primary credentials can repeatedly submit guessed OTP values until one is accepted, and because the OTP is bound to the user rather than to a single pending login, multiple concurrent sessions can guess against the same OTP. This makes guessing the second factor feasible and can lead to unauthorized access to the affected user's MISP account (high confidentiality and integrity impact per the CVSS 4.0 score of 8.6). Only MISP deployments with email OTP authentication enabled are affected, and exploitation requires valid primary credentials, limiting exposure to accounts that use this second factor. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation is reported; EPSS assigns a 0.3% probability of exploitation within 30 days.

What to do: Upgrade MISP to the release that integrates the existing brute-force protection into the email OTP flow (failed attempts counted per user, active OTP invalidated once the configured threshold is reached, blocklisted users blocked from requesting fresh OTPs, and OTP comparison hardened with hash_equals() plus string-type validation); the exact fixed version number is not stated in the available data, so confirm via the MISP advisory or changelog. In the interim, review authentication logs for accounts showing many failed OTP attempts and verify whether email OTP is enabled on your instance.