Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85237— Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

Quick assessment

Affected
misp misp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 基于电子邮件的一次性密码（OTP）认证流程中存在一个漏洞，允许攻击者进行不限次数的 OTP 验证尝试。 在验证提交的 OTP 值时， 端点未应用防暴力破解机制。一旦攻击者进入 OTP 验证阶段（例如在成功提供用户的主认证凭据之后），他们可以在同一个 OTP 仍然有效期间反复提交候选 OTP 值。这显著提高了猜解 OTP 的可能性，从而可能绕过第二认证因子，最终导致对受影响用户账户的未授权访问。 该问题因 OTP 与用户关联而非与单个待处理登录会话关联而进一步恶化，使得多个并发会话能够针对同一个有效 OTP

CVSS 8.6 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
misp misp ≤ 2.5.45 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85237

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP verification stage, for example after successfully providing a user's primary authentication credentials, could repeatedly submit candidate OTP values while the same OTP remained valid. This significantly increased the feasibility of guessing the OTP and bypassing the additional authentication factor, potentially resulting in unauthorized access to the affected user's account. The issue was exacerbated by the fact that the OTP is associated with the user rather than with an individual pending login session, allowing multiple concurrent sessions to attempt guesses against the same valid OTP. The patch integrates the existing MISP brute-force protection mechanism into the email OTP flow. Failed OTP attempts are now counted against the user, further attempts are rejected once the configured threshold is reached, and the active OTP is invalidated when the attempt budget is exhausted. Blocklisted users are also prevented from requesting the generation of a fresh OTP. In addition, OTP comparison now uses hash_equals() and validates that the submitted value is a string.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
misp misp 0 ~ 2.5.45 -

II. Public POCs for CVE-2026-85237

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85237

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-85237 (1)

Same Patch Batch · misp · 2026-09-03 · 9 CVEs total

CVE-2026-85216 9.5 CRITICAL MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
CVE-2026-85236 8.8 HIGH MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
CVE-2026-85221 7.6 HIGH MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attack
CVE-2026-85238 7.6 HIGH Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
CVE-2026-85239 7.1 HIGH MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
CVE-2026-85227 6.1 MEDIUM Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAtta
CVE-2026-85226 5.3 MEDIUM MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Co
CVE-2026-85230 5.3 MEDIUM MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

IV. Related Vulnerabilities

Same product: misp
Same vendor: misp
Same weakness: CWE-307

V. Comments for CVE-2026-85237

No comments yet

Leave a comment