A critical authentication bypass vulnerability in MISP allows unauthenticated remote attackers to impersonate privileged users, potentially leading to full compromise of sensitive threat intelligence data.

The vulnerability exists within the custom LdapAuthenticate and LinOTPAuthenticate components, which fail to properly validate user credentials. An unauthenticated attacker can supply empty passwords to trigger successful authentication against LDAP servers or local fallback mechanisms, effectively bypassing standard security controls.

Successful exploitation grants an attacker full access to the MISP platform with the privileges of the targeted account. Given the nature of MISP as a repository for sensitive threat intelligence, this could result in unauthorized data exfiltration, the injection of malicious indicators, or the total compromise of the platform's integrity. With a CVSS score of 9.5, this vulnerability represents an extreme risk to organizational security operations.

Immediate Action: Upgrade MISP to the latest patched version immediately to ensure that credential validation logic is correctly enforced.

Proactive Monitoring: Review application access logs for anomalous authentication patterns, specifically looking for successful logins that lack corresponding password submission data.

Compensating Controls: If an immediate upgrade is not feasible, ensure that backend LDAP servers are configured to reject unauthenticated binds and disable mixed authentication modes if possible.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a severe risk to any organization utilizing MISP for threat intelligence management. Administrators must prioritize the application of the vendor-provided patch, as the ability for an unauthenticated user to impersonate an administrator constitutes a critical security failure. Ensure that all authentication components are validated against the latest software release to prevent unauthorized system access.