A critical authentication bypass vulnerability in MISP allows unauthenticated attackers to circumvent security controls, posing a severe risk of unauthorized account access.

The login() function in UsersController.php improperly validates HTTP methods, allowing an unauthenticated attacker to bypass brute-force mitigation, email OTP verification, and login-failure logging by using non-standard HTTP methods.

The ability to bypass multi-factor authentication and brute-force protections significantly lowers the barrier for unauthorized access to sensitive threat intelligence data. Successful exploitation could lead to account takeovers, potentially exposing proprietary intelligence or allowing malicious actors to manipulate data within the MISP instance. While the CVSS score is 6.9, the ability for an unauthenticated attacker to defeat core authentication security mechanisms warrants high-priority remediation.

Immediate Action: Upgrade all MISP instances to version 2.5.47 or later to implement the corrected HTTP method validation logic.

Proactive Monitoring: Review web server access logs for unusual HTTP methods (such as PATCH, DELETE, or OPTIONS) directed at the login endpoint, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to enforce strict HTTP method filtering on the login endpoint, ensuring only authorized POST/PUT requests are processed.

Public Exploit Available: exploit_available (unknown)

The bypass of multiple security controls, including MFA and rate-limiting, represents a significant degradation of the platform's security posture. Administrators should prioritize the update to version 2.5.47 immediately to restore essential authentication safeguards and prevent potential credential compromise.