CVE-2026-85238

MISP contains a session fixation vulnerability (CWE-384) in its CustomAuth authentication flow, an optional custom authentication configuration. When a user authenticates via CustomAuth, MISP writes the authenticated user into the existing CakePHP session without rotating the session identifier, because the call to Session->renew() had been disabled. An attacker who can cause a victim to authenticate using a session identifier known to the attacker can then reuse that same identifier to take over the victim's authenticated session and gain the privileges of the victim's account. Only MISP instances with CustomAuth authentication enabled are affected. No public proof-of-concept is known, EPSS is low (0.2% probability of exploitation within 30 days), the issue is not in CISA's KEV, and there is no indication of exploitation in the wild.

What to do: Upgrade MISP to the patched release that restores session-identifier renewal when a new authentication occurs or the authenticated user changes (see the vendor advisory for the exact version). Check whether CustomAuth authentication is enabled on your instance; if so, prioritize patching, and as an interim measure avoid scenarios where victims' session IDs could be pre-set by an attacker (e.g., shared or attacker-influenced links/environments) and review active sessions for reuse. Do not disable session renewal unnecessarily once updated.