Summary
CVE-2026-90961 is an authentication bypass vulnerability in MISP’s LdapAuth and LinOTPAuth authentication plugins. The LdapAuthenticate.php and LinOTPAuthenticate.php components replace CakePHP’s built-in FormAuthenticate class but fail to reproduce its input-validation guard, so empty or non-string credentials submitted at login are forwarded to the underlying authentication logic. An attacker who knows a valid user email can authenticate without a correct password, and the flaw carries a CVSS score of 9.3 (Critical).
Technical details
- Root cause: LdapAuthenticate.php and LinOTPAuthenticate.php extract the email and password fields from the login request without verifying that both are non-empty strings, unlike CakePHP’s native
_checkFields()guard that they were meant to replicate. - LDAP path: an empty or null password is passed through to
ldap_bind(). Per RFC 4513 §5.1.2, a bind request with a valid DN and an empty password is treated as an "unauthenticated bind," which many LDAP directory servers accept as successful — granting access to any known email address with no password. - LinOTP path: the same missing validation allows non-string credentials to be concatenated into the LinOTP verification request; in the mixed-authentication branch, an empty submitted password can also match a locally stored hash of an empty string.
- Secondary issue: LDAP accounts auto-provisioned on first login were previously saved with an empty password (validation was skipped on that save path). If such a user later disappears from LDAP and the mixed-authentication fallback is used, the stored hash of the empty string will verify against an empty submitted password.
- Attack vector: network-based, no user interaction required. Exploitation requires that the LdapAuth or LinOTPAuth plugin be enabled on the MISP instance, and that the attacker know at least one valid user email registered in the directory or MISP’s user store.
- Impact: full authentication bypass, allowing an attacker to log in as an existing user without valid credentials.
Affected software
- MISP, all versions from the beginning up to and including 2.5.45, when the LdapAuth or LinOTPAuth authentication plugin is enabled.
Severity
- CVSS v4.0 Base Score: 9.3 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: upgrade to MISP 2.5.46 or later, which rejects empty and non-string credentials before they reach
ldap_bind()or the LinOTP verifier, replaces empty passwords assigned to auto-provisioned LDAP accounts with randomly generated values, and refuses empty passwords in the mixed-authentication fallback path. - If immediate patching is not possible: disable the LdapAuth and/or LinOTPAuth plugins until the upgrade can be applied, or restrict login access to trusted networks only.
- Review MISP user accounts for any created via LDAP auto-provisioning to confirm none retain an empty stored password, and audit authentication logs for anomalous logins using known email addresses with blank or unusual password values.