{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90961 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-90961 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-90961 is a critical authentication bypass vulnerability in MISP, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90961 and fix it if it is affected.\n\nWhat it is: CVE-2026-90961 is a critical authentication bypass vulnerability in MISP, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90961 in the wild and no public exploit code.\n\nAffected product: MISP. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90961/ (Markdown: https://insights.sbomify.com/CVE-2026-90961/index.md)","id":"CVE-2026-90961","markdown":"https://insights.sbomify.com/CVE-2026-90961/index.md","name":"CVE-2026-90961","record":{"aliases":["GHSA-5wh5-3jx8-w3gh"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"MISP threat sharing platform","requires_auth":"none","summary":"Attackers can bypass authentication in MISP by exploiting missing input validation in LDAP and LinOTP plugins, allowing unauthorized access if valid email addresses are known.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"CIRCL","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings.\n\nIn the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes.\n\nIn the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string.\n\nA secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access.\n\nThe vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data.\n\nVersion affected: ≤2.5.45","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials","id":"CVE-2026-90961","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Missing authorization in Server","id":"CVE-2026-90969"},"packages":[],"prev":{"headline":"Path traversal in Red Hat Ansible Automation Platform 2","id":"CVE-2026-90959"},"products":["MISP"],"published":"2026-09-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["MISP"]},"summary":"Attackers can bypass authentication in MISP by exploiting missing input validation in LDAP and LinOTP plugins, allowing unauthorized access if valid email addresses are known.","url":"https://insights.sbomify.com/CVE-2026-90961/"}