PT-2026-42189 · Misp · Misp

Ali Ganiyev + 1 · CVE-2026-9084 · Published 2026-05-20 · Updated 2026-05-20

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description The OIDC authentication plugin allows automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account lacks a stored sub value. In scenarios with insecure or untrusted Identity Provider (IdP) configurations where email ownership is not verified, an attacker possessing a valid OIDC token can assert a victim's email address to authenticate as that user, resulting in account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-9084

Affected Products

Misp

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9084.json · Exploit
• https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172 · Patch
• https://osv.dev/vulnerability/CVE-2026-9084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9084 · Security Note
• https://t.me/CVEtracker/54405 · Telegram Post