A critical authentication bypass vulnerability in the MISP LdapAuth and LinOTPAuth plugins allows unauthenticated attackers to gain full user access without a valid password.

The vulnerability stems from a failure to implement input validation guards in the LdapAuthenticate and LinOTPAuthenticate classes. This allows an unauthenticated attacker to bypass authentication logic by submitting empty or non-string credentials, which are subsequently accepted by the directory or the application.

The ability to bypass authentication grants an attacker the full privileges of the impersonated user. Given that MISP is used for sensitive threat intelligence, this could result in unauthorized access to confidential threat data, potential modification of intelligence feeds, or full administrative compromise, justifying the CVSS score of 9.3.

Immediate Action: Update MISP to version 2.5.46 or later, which introduces mandatory type and emptiness validation for credential fields.

Proactive Monitoring: Review authentication and access logs for unusual login patterns, specifically looking for successful sessions associated with empty or malformed credentials.

Compensating Controls: If immediate patching is not feasible, disable the LdapAuth and LinOTPAuth plugins temporarily or implement strict network-level access controls to restrict access to the MISP login interface.

Public Exploit Available: Unknown

This is a high-severity vulnerability requiring immediate attention. Organizations utilizing MISP with LDAP or LinOTP authentication should verify their current version and apply the 2.5.46 update as a priority to prevent potential unauthorized access to sensitive threat intelligence environments.