A vulnerability in the MISP email-based OTP authentication flow allows an attacker with primary credentials to bypass multi-factor authentication, posing a high risk of unauthorized account access.

This vulnerability involves an improper restriction of excessive authentication attempts (CWE-307) within the email_otp() endpoint, which lacks rate limiting for OTP verification. An attacker who has already obtained a user's primary credentials can perform an unrestricted number of guesses to bypass the second authentication factor.

Successful exploitation of this flaw allows unauthorized actors to bypass multi-factor authentication, leading to full account compromise. Given the CVSS score of 8.6, this represents a high-severity risk to the confidentiality and integrity of sensitive intelligence data managed within MISP. Unauthorized access could result in the exfiltration of classified threat information or the manipulation of intelligence feeds, causing significant reputational and operational damage.

Immediate Action: Update MISP to the latest version that integrates brute-force protection into the email OTP flow, as identified in the vendor security advisory.

Proactive Monitoring: Review authentication and access logs for patterns indicative of brute-force attempts, such as high frequencies of failed OTP requests originating from a single user account.

Compensating Controls: Ensure that account lockout policies are strictly enforced at the identity provider level and monitor for concurrent login sessions that deviate from established user behavior baselines.

Public Exploit Available: No

This vulnerability presents a significant risk to the integrity of authentication within the MISP platform. Administrators must prioritize updating the software to the version containing the integrated brute-force protection mechanisms. Failure to remediate this flaw leaves accounts vulnerable to credential-based attacks that bypass secondary security layers, potentially exposing sensitive intelligence assets to unauthorized parties.