CVE-2026-107276: MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.
Preconditions:
- The target MISP instance has email OTP login enabled.
- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).
- The attacker can issue two HTTP POST requests in close temporal proximity.
Impact:
- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.
- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.
Affected versions: <2.5.48
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which MISP deployments are exposed?
MISP instances running versions earlier than 2.5.48 are affected if email-based OTP login is enabled. Instances without email OTP login enabled do not meet the stated precondition.
What does an attacker need to exploit this issue?
The attacker must possess a valid, unexpired email OTP and submit two HTTP POST requests carrying that OTP concurrently. The OTP could be obtained through email interception or social engineering.
What is the practical impact of a successful exploit?
The same OTP can establish two authenticated sessions instead of being limited to one use. This can enable unauthorized access when an OTP is intercepted or shared.
What should be prioritized for remediation?
Upgrade affected MISP installations to version 2.5.48 or later. Until upgrading, reduce exposure by disabling email OTP login where operationally feasible and protecting access to OTP emails.