CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
Attackers can reuse a single email OTP to create multiple sessions due to a race condition, bypassing one-time use restrictions in MISP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107276?
CVE-2026-107276 is a medium-severity vulnerability in MISP, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.
Preconditions:
- The target MISP instance has email OTP login enabled.
- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).
- The attacker can issue two HTTP POST requests in close temporal proximity.
Impact:
- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.
- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.
Affected versions: <2.5.48
Which versions are affected by CVE-2026-107276?
How do I fix CVE-2026-107276?
No fix has been published for CVE-2026-107276 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107276 being exploited?
There is no known exploitation of CVE-2026-107276 in the wild and no public exploit code.
Sources
Also known as GHSA-fjjq-85mx-vg3v.