PT-2026-45744 · Misp · Misp

Andrea Capelli + 1 · CVE-2026-10611 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An authentication bypass occurs when LDAP mixed authentication is enabled alongside OTP enforcement. In configurations where LdapAuth.mixedAuth is set to true and Security.require otp is set to true, the application may establish an authenticated session during the beforeFilter phase before the standard login flow enforces the OTP challenge. This allows an attacker with valid primary credentials to bypass the OTP step by authenticating via the plugin-backed flow and directly accessing an application URL, gaining access without a valid TOTP, HOTP, or email OTP code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-10611

Affected Products

Misp

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10611.json · Exploit
• https://github.com/MISP/MISP/commit/39b3cb15aac4318afdd2ab63b96c2eac12b271fe · Patch
• https://osv.dev/vulnerability/CVE-2026-10611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10611 · Security Note
• https://twitter.com/VulmonFeeds/status/2061895314617835952 · Twitter Post
• https://t.me/CVEtracker/55599 · Telegram Post