Skip to content
Heist/ feed
High

MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

Type: advisorySource: Official CVE List1 source record

On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup. The initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag). Impact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy. Affected version: <2.5.48

Announced Source revision 1
Original source ↗

CVE-2026-107180

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-107180

MISP

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/MISP/MISP",
    "vendor": "MISP",
    "modules": [
      "app/Controller/AppController.php (login / user verification / TOTP enforcement)"
    ],
    "product": "MISP",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.5.48",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "app/Controller/AppController.php"
    ]
  }
]
Related CVEs
CVE-2026-107180

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#11888 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement