CVE-2026-94379 (GCVE-0-2026-94379)

Vulnerability from cvelistv5 – Published: 2026-09-21 12:35 – Updated: 2026-09-21 15:21
VLAI
Title
MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
Summary
The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:   - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked  -  the email OTP two-factor authentication step was skipped, defeating the second factor of authentication  - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:20 UTC
CWE
  • CWE-20 - Improper Input Validation
  • CWE-285 - Improper Authorization
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: unspecified , < 2.5.47 (semver)
guessed Create a notification for this product.
Credits
Jeroen Pinoy iglocska
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Review: review GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-21 12:30
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/ef4dc19c6.patch ff6f133b194f…
Confidence
medium
Commit Subject Patch SHA-256
ef4dc19c6d4f fix: [security] insufficient check on http methods for the ff6f133b194f…
Fix summary

The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method—regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other—triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.

Patch summary

Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this->request->is(['post','put']) to !$this->request->is(['get']). (2) The email-OTP guard changed from $this->request->is('post') to !$this->request->is(['get']). (3) The login-failure handling guard changed from $this->request->is('post') || $this->request->is('put') to !$this->request->is('get'). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.

CVSS rationale

AV:N – the login endpoint is network-accessible. AC:L – the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N – no manipulation of the target system is needed. PR:N – the login endpoint is accessible without prior authentication. UI:N – no user interaction required. VC:L – bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L – bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N – no direct denial-of-service impact. SC/SI/SA:N – no secondary system impact is evidenced.

Weakness rationale
  • CWE-20 The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic.
  • CWE-285 The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls.
Attack pattern rationale
  • CAPEC-1 The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls.
Assumptions to verify
  • The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.
  • The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.
  • The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.
  • The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.
  • It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 5 9 medium 5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:20:43.610267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:01.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController (login endpoint)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\u003cbr\u003e\u2003-\u0026nbsp; the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\u003cbr\u003e\u003cdiv\u003e\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u00a0\n\n\u2003-\u00a0the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n\u2003-\u00a0 the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improperly Controlled Modification of Authentication Logic"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:35:26.533Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ef4dc19c6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass."
        }
      ],
      "title": "MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.",
                  "The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.",
                  "The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.",
                  "The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.",
                  "It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls."
                  }
                ],
                "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N \u2013 the login endpoint is network-accessible. AC:L \u2013 the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N \u2013 no manipulation of the target system is needed. PR:N \u2013 the login endpoint is accessible without prior authentication. UI:N \u2013 no user interaction required. VC:L \u2013 bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L \u2013 bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N \u2013 no direct denial-of-service impact. SC/SI/SA:N \u2013 no secondary system impact is evidenced.",
                "fixSummary": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.",
                "generatedAt": "2026-09-21T12:30:02.387878Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                "patchSummary": "Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this-\u003erequest-\u003eis([\u0027post\u0027,\u0027put\u0027]) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (2) The email-OTP guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (3) The login-failure handling guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027) to !$this-\u003erequest-\u003eis(\u0027get\u0027). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                    "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                    "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "subject": "fix: [security] insufficient check on http methods for the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                "subject": "fix: [security] insufficient check on http methods for the",
                "tagVersionBoundary": {
                  "commits_after_fix": 143,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20013"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94379",
    "datePublished": "2026-09-21T12:35:26.533Z",
    "dateReserved": "2026-09-21T12:35:24.635Z",
    "dateUpdated": "2026-09-21T15:21:01.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "modules": [
                  "UsersController (login endpoint)"
                ],
                "product": "MISP",
                "programFiles": [
                  "app/Controller/UsersController.php"
                ],
                "repo": "https://github.com/MISP/MISP",
                "vendor": "MISP",
                "versions": [
                  {
                    "lessThan": "2.5.47",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u00a0\n\n\u2003-\u00a0the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n\u2003-\u00a0 the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: \u003c2.5.47"
          }
        ],
        "id": "CVE-2026-94379",
        "lastModified": "2026-09-21T16:17:30.397",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-94379",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:20:43.610267Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-21T13:17:13.200",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/MISP/MISP/commit/ef4dc19c6"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-94379",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-21T15:20:43.610267Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-21T15:20:49.002Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "modules": [
                "UsersController (login endpoint)"
              ],
              "product": "MISP",
              "programFiles": [
                "app/Controller/UsersController.php"
              ],
              "repo": "https://github.com/MISP/MISP",
              "vendor": "MISP",
              "versions": [
                {
                  "lessThan": "2.5.47",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Jeroen Pinoy"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "iglocska"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\u003cbr\u003e\u2003-\u0026nbsp; the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\u003cbr\u003e\u003cdiv\u003e\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
                }
              ],
              "value": "The login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u00a0\n\n\u2003-\u00a0the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n\u2003-\u00a0 the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: \u003c2.5.47"
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Improperly Controlled Modification of Authentication Logic"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20 Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285 Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-21T12:35:26.533Z",
            "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "shortName": "CIRCL"
          },
          "references": [
            {
              "name": "Security patch",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/MISP/MISP/commit/ef4dc19c6"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.\u003c/p\u003e"
                }
              ],
              "value": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass."
            }
          ],
          "title": "MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)",
          "x_gcve": [
            {
              "extensions": {
                "bcp-05-x-01": {
                  "ai_annotations": [
                    {
                      "ai_level": "generated",
                      "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                      "gna_source": 1,
                      "models": [
                        {
                          "gna_source": 1,
                          "identifier": "qwen3.8:27b",
                          "name": "qwen3.8:27b",
                          "source": "ollama"
                        }
                      ],
                      "review_status": "review",
                      "scope": "record",
                      "tags": [
                        "ai-computer-assisted:llm-generated",
                        "ai-computer-assisted:classification"
                      ]
                    }
                  ]
                },
                "bcp-05-x-02": {
                  "x_patch2vuln": {
                    "assumptions": [
                      "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.",
                      "The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.",
                      "The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.",
                      "The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.",
                      "It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent."
                    ],
                    "capecRationale": [
                      {
                        "capecId": "CAPEC-1",
                        "rationale": "The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls."
                      }
                    ],
                    "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                    "confidence": "medium",
                    "credits": [
                      {
                        "lang": "en",
                        "type": "reporter",
                        "value": "Jeroen Pinoy"
                      },
                      {
                        "lang": "en",
                        "type": "remediation developer",
                        "value": "iglocska"
                      }
                    ],
                    "cvssRationale": "AV:N \u2013 the login endpoint is network-accessible. AC:L \u2013 the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N \u2013 no manipulation of the target system is needed. PR:N \u2013 the login endpoint is accessible without prior authentication. UI:N \u2013 no user interaction required. VC:L \u2013 bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L \u2013 bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N \u2013 no direct denial-of-service impact. SC/SI/SA:N \u2013 no secondary system impact is evidenced.",
                    "fixSummary": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.",
                    "generatedAt": "2026-09-21T12:30:02.387878Z",
                    "generator": "patch2vuln.py",
                    "model": "qwen3.8:27b",
                    "modelComparison": {
                      "rankings": [
                        {
                          "agreementScore": 9,
                          "assumptionCount": 5,
                          "confidence": "medium",
                          "model": "qwen3.8:27b",
                          "score": 5
                        }
                      ],
                      "selectedModel": "qwen3.8:27b",
                      "selectionMethod": "deterministic-consensus-v1",
                      "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                    },
                    "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                    "patchSummary": "Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this-\u003erequest-\u003eis([\u0027post\u0027,\u0027put\u0027]) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (2) The email-OTP guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (3) The login-failure handling guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027) to !$this-\u003erequest-\u003eis(\u0027get\u0027). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.",
                    "patchTruncated": false,
                    "patches": [
                      {
                        "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                        "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                        "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                        "sourceUrl": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                        "subject": "fix: [security] insufficient check on http methods for the"
                      }
                    ],
                    "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "subject": "fix: [security] insufficient check on http methods for the",
                    "tagVersionBoundary": {
                      "commits_after_fix": 143,
                      "repository": "https://github.com/MISP/MISP",
                      "tag": "v2.5.47",
                      "version": "2.5.47",
                      "version_type": "semver"
                    },
                    "weaknessRationale": [
                      {
                        "cweId": "CWE-20",
                        "rationale": "The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic."
                      },
                      {
                        "cweId": "CWE-285",
                        "rationale": "The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls."
                      }
                    ]
                  }
                }
              },
              "recordType": "advisory",
              "vulnId": "GCVE-1-2026-20013"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "assignerShortName": "CIRCL",
        "cveId": "CVE-2026-94379",
        "datePublished": "2026-09-21T12:35:26.533Z",
        "dateReserved": "2026-09-21T12:35:24.635Z",
        "dateUpdated": "2026-09-21T15:21:01.092Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.