CVE-2026-85238: Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.
As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account.
The issue occurs because customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the patch behavior that restores session identifier rotation when a new authentication occurs or when the authenticated user changes, avoiding unnecessary session renewal on every request (the fix is that __customAuthentication() should rotate the session identifier before storing the authenticated user in the existing session).
MISP (CustomAuth authentication flow) CakePHP Session->renew() during authentication = enabled for session identifier rotation on authentication/user change
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects MISP deployments that use the CustomAuth authentication flow. The description identifies CustomAuth as a custom configuration, so exposure depends on whether that authentication method is enabled and used.
What must an attacker do to exploit the vulnerability?
The attacker must cause a victim to use a session identifier that the attacker already knows before the victim authenticates through CustomAuth. If the victim then successfully logs in, the attacker can reuse that fixed identifier to access the authenticated session.
What access could an attacker obtain?
An attacker who successfully reuses the fixed session identifier could access the victim's authenticated MISP session. The resulting access may include the privileges associated with the victim's account.
What changes with the fix?
The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes. It avoids renewing the session identifier unnecessarily on every request.