目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-103651— MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

一分钟漏洞结论

影响对象
MISP MISP
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

MISP 在其一次性密码（OTP）认证流程中存在一个漏洞，该漏洞允许攻击者重放已使用的 HOTP（纸质令牌）并回退令牌计数器。 HOTP 验证逻辑将提交的令牌与用户在输入密码时缓存于会话中的计数器值进行比较，而不是与数据库中存储的权威计数器进行比较。由于在令牌成功消费后，会话中缓存的计数器并未更新，因此持有有效会话（即已完成密码输入步骤）的攻击者可以重用之前已“烧毁”的 HOTP 令牌。过期的缓存计数器仍能与重放的令牌匹配，从而允许第二次成功认证，并实质上回退了计数器的状态。 前提条件： 目标用户已启用 HOTP（

CVSS 7.6 · High
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-103651 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
来源: CVE Program / CVE List V5
Vulnerability Description
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. The stale cached counter still matches the replayed token, granting a second successful authentication and effectively rewinding the counter state. Preconditions: - The target user has HOTP (paper token) second-factor authentication enabled. - The attacker possesses a valid session in which the password step has already been completed (the OTP step is pending). - The attacker has access to at least one HOTP token value (e.g., a paper token list). Security impact: - Bypass of the second authentication factor, allowing unauthorized access to a user's MISP account. - Corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays. Affected versions: <2.5.48.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

二、漏洞 CVE-2026-103651 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-103651 的情报信息

请登录查看更多情报信息。

CVE-2026-103651 其他参考 (1)

同批安全公告 · MISP · 2026-10-01 · 共 6 条

CVE-2026-103655 9.3 CRITICAL MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
CVE-2026-103659 7.1 HIGH MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attrib
CVE-2026-103858 5.3 MEDIUM MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussio
CVE-2026-103662 5.1 MEDIUM MISP Reflected XSS in Taxonomy Tag Confirmation Forms
CVE-2026-103664 4.8 MEDIUM MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-362

V. Comments for CVE-2026-103651

暂无评论

发表评论