CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
Attackers can hijack user sessions in MISP when CustomAuth is enabled by reusing pre-authentication session identifiers, leading to unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85238?
CVE-2026-85238 is a high-severity authentication bypass vulnerability in Misp-Project Misp, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.
As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account.
The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.
Weakness: CWE-384
Which versions are affected by CVE-2026-85238?
It affects 1 product.
Products include Misp-Project Misp.
How do I fix CVE-2026-85238?
No fix has been published for CVE-2026-85238 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85238 being exploited?
There is no known exploitation of CVE-2026-85238 in the wild and no public exploit code.
Other vulnerabilities in Misp-Project Misp
Sources
Also known as GHSA-q8j2-7wc6-q8m4.