A flaw in the MISP authentication logic allows disabled accounts to reach the TOTP verification stage, potentially exposing login behavior information.

This is an improper authentication vulnerability (CWE-285) occurring in the UsersController login method. The application fails to include the user status field in a database query, causing the system to treat disabled accounts as active during the initial TOTP prompt phase, even though subsequent re-validation prevents full access.

The practical security impact is minimal, as the vulnerability does not grant unauthorized access to the system. However, the flaw causes a predictable difference in login responses for disabled users, which may be leveraged for minor account enumeration or information disclosure. The CVSS score of 6.9 reflects the potential for unauthenticated interaction, though the actual risk is mitigated by secondary security checks within the application.

Immediate Action: Update the MISP instance to version 2.5.47 or later to ensure the user status check is correctly enforced during the initial authentication phase.

Proactive Monitoring: Review application logs for persistent PHP "Undefined array key" warnings, which may indicate attempted exploitation of this logic flaw.

Compensating Controls: While this issue is primarily a logic flaw, ensure that standard web application security best practices are in place to monitor for anomalous login patterns or brute force attempts.

Public Exploit Available: No (exploit_available: unknown)

While the risk associated with this vulnerability is limited, organizations should prioritize the update to version 2.5.47 as part of routine maintenance. Applying the patch will resolve the underlying logic error, eliminate unnecessary PHP warnings in the application logs, and ensure consistent enforcement of account access policies.