CVE-2026-103655— MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
一分钟漏洞结论
影响对象
MISP MISP
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
MISP 在其双因素认证（TOTP）验证流程中存在一个漏洞，允许有效的一次性验证码在其基于时间的有效期内被多次接受。 该问题存在于用户登录流程中，其中 TOTP 代码作为第二认证因子进行验证。由于系统未记录某个特定的 TOTP 时间窗口是否已被使用过，同一验证码在其整个有效时间窗口内（通常为 30 秒）保持有效。攻击者如果在用户合法登录过程中截获了有效的验证码，可以重放该代码以冒充该用户认证第二个会话。 前提条件： 目标用户已启用基于 TOTP 的双因素认证。 攻击者能够观察或拦截用户在合法登录过程中输入的 TOT
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-103655 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
来源: CVE Program / CVE List V5
Vulnerability Description
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window.
The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.
Preconditions:
- The target user has TOTP-based two-factor authentication enabled.
- The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client).
- The replay must occur within the TOTP validity period.
Security impact:
- Unauthorized account access by replaying a captured one-time code.
- Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user.
Affected versions: <v2.5.48.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-103655 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-103655 的情报信息
请登录查看更多情报信息。
CVE-2026-103655 其他参考 (1)
同批安全公告 · MISP · 2026-10-01 · 共 6 条
| CVE-2026-103651 | 7.6 HIGH | MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authenticatio |
| CVE-2026-103659 | 7.1 HIGH | MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attrib |
| CVE-2026-103858 | 5.3 MEDIUM | MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussio |
| CVE-2026-103662 | 5.1 MEDIUM | MISP Reflected XSS in Taxonomy Tag Confirmation Forms |
| CVE-2026-103664 | 4.8 MEDIUM | MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter |
IV. Related Vulnerabilities
Same product: MISP
-
CVE-2026-103858
MISP Incomplete Thread Authorization Allows Unauthorized Rea -
CVE-2026-103664
MISP Reflected Cross-Site Scripting via Unsanitized Analyst -
CVE-2026-103662
MISP Reflected XSS in Taxonomy Tag Confirmation Forms -
CVE-2026-103659
MISP: Object Distribution ACL Bypass via Event Flattening Ex -
CVE-2026-103651
MISP HOTP Token Replay via Stale Session-Cached Counter Allo
Same vendor: MISP
-
CVE-2026-103858
MISP Incomplete Thread Authorization Allows Unauthorized Rea -
CVE-2026-103664
MISP Reflected Cross-Site Scripting via Unsanitized Analyst -
CVE-2026-103662
MISP Reflected XSS in Taxonomy Tag Confirmation Forms -
CVE-2026-103659
MISP: Object Distribution ACL Bypass via Event Flattening Ex -
CVE-2026-103651
MISP HOTP Token Replay via Stale Session-Cached Counter Allo
V. Comments for CVE-2026-103655
暂无评论