CVE-2026-103655: MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window.
The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.
Preconditions:
- The target user has TOTP-based two-factor authentication enabled.
- The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client).
- The replay must occur within the TOTP validity period.
Security impact:
- Unauthorized account access by replaying a captured one-time code.
- Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user.
Affected versions: <v2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which deployments and users are exposed to this issue?
MISP versions earlier than v2.5.48 are affected when a target user has TOTP-based two-factor authentication enabled. Users without TOTP enabled are not subject to this specific replay scenario.
What does an attacker need to successfully exploit it?
The attacker must capture or observe a legitimate user's TOTP code during login, such as through network-level interception, shoulder surfing, or a compromised client. They must replay that code before its validity window expires, typically within 30 seconds.
Can an attacker use a captured code repeatedly?
A captured valid code can be accepted more than once during the same TOTP validity period because the affected login flow does not record that the TOTP period has already been consumed. This allows the attacker to authenticate a second session as the targeted user within that window.
What is the immediate mitigation?
Upgrade MISP to v2.5.48 or later. Until upgrading, reduce the chance of code capture by protecting login clients and preventing interception or observation of TOTP codes during authentication.