The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:
- the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blockedThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.
Version affected: <2.5.47
"}],"value":"The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: \n\n - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: <2.5.47"}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Improperly Controlled Modification of Authentication Logic"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-21T12:35:26.533Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/ef4dc19c6"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method—regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other—triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.
"}],"value":"The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method—regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other—triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass."}],"title":"MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"review","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.","The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.","The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.","The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.","It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent."],"capecRationale":[{"capecId":"CAPEC-1","rationale":"The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls."}],"commit":"ef4dc19c6d4f029c3173e5fafea75a94c127f8b5","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"}],"cvssRationale":"AV:N – the login endpoint is network-accessible. AC:L – the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N – no manipulation of the target system is needed. PR:N – the login endpoint is accessible without prior authentication. UI:N – no user interaction required. VC:L – bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L – bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N – no direct denial-of-service impact. SC/SI/SA:N – no secondary system impact is evidenced.","fixSummary":"The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method—regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other—triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.","generatedAt":"2026-09-21T12:30:02.387878Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8","patchSummary":"Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this->request->is(['post','put']) to !$this->request->is(['get']). (2) The email-OTP guard changed from $this->request->is('post') to !$this->request->is(['get']). (3) The login-failure handling guard changed from $this->request->is('post') || $this->request->is('put') to !$this->request->is('get'). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.","patchTruncated":false,"patches":[{"commit":"ef4dc19c6d4f029c3173e5fafea75a94c127f8b5","patchSha256":"ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8","source":"https://github.com/MISP/MISP/commit/ef4dc19c6.patch","sourceUrl":"https://github.com/MISP/MISP/commit/ef4dc19c6.patch","subject":"fix: [security] insufficient check on http methods for the"}],"source":"https://github.com/MISP/MISP/commit/ef4dc19c6.patch","subject":"fix: [security] insufficient check on http methods for the","tagVersionBoundary":{"commits_after_fix":143,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-20","rationale":"The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic."},{"cweId":"CWE-285","rationale":"The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20013"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-94379","datePublished":"2026-09-21T12:35:26.533Z","dateReserved":"2026-09-21T12:35:24.635Z","dateUpdated":"2026-09-21T15:21:01.092Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-21 13:17:13","lastModifiedDate":"2026-09-21 16:17:30","problem_types":["CWE-20","CWE-285","CWE-20 CWE-20 Improper Input Validation","CWE-285 CWE-285 Improper Authorization"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-21T15:20:43.610267Z","id":"CVE-2026-94379","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"94379","Ordinal":"1","Title":"MISP: HTTP Method Bypass of Login Security Controls (Bruteforce ","CVE":"CVE-2026-94379","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"94379","Ordinal":"1","NoteData":"The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: \n\n - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: <2.5.47","Type":"Description","Title":"MISP: HTTP Method Bypass of Login Security Controls (Bruteforce "}]}}}