CVE-2026-103651

Executive Summary

CVE-2026-103651 is an authentication weakness in MISP (Malware Information Sharing Platform) affecting versions prior to 2.5.48. A flaw in the HOTP (paper token) one-time password verification flow permits replay of an already-consumed token and rewinding of the token counter, because verification is performed against a session-cached counter value instead of the authoritative database counter. An attacker holding a valid session that has passed the password step (with the OTP step still pending) and knowledge of at least one HOTP token value can bypass the second authentication factor and gain unauthorized access to a MISP account, while corrupting the HOTP counter state.

Technical Analysis

HOTP (HMAC-based One-Time Password, RFC 4226) is a counter-based OTP scheme. Each successful authentication is expected to advance a monotonically increasing counter, and the server is expected to reject any token whose counter value is less than or equal to the last acknowledged value—this is the core anti-replay property of HOTP. A consumed token must never validate again.

In the affected MISP implementation, the HOTP verification logic does not compare the submitted token against the authoritative counter stored in the database. Instead, it compares the submitted token against a counter value that was cached in the user's session at the time the password was entered. This design choice introduces a state synchronization defect: because the session-cached counter is not updated after a token is successfully consumed, it remains frozen at the pre-consumption value for the lifetime of that session.

The security consequence is twofold:

1. Replay of a consumed token. After a token is successfully used to complete the OTP step, the cached counter is not advanced. If the same session (or a session retaining the same cached counter) presents a valid session whose OTP step is pending, the stale cached counter still matches the replayed token. Verification succeeds a second time, granting another successful authentication.

2. Counter rewind. Because the authoritative database counter is bypassed as the comparison source, the attacker's replay effectively rewinds the observable counter state from the attacker's perspective. This creates the risk of invalidating subsequent legitimate tokens: if the legitimate user's client advances to the next counter value, tokens derived from the true current counter may fall out of sync with what the server accepts, or the attacker may be able to extend the replay window further.

The root cause is a trust-boundary error: a client/session-scoped value (the session cache) is treated as authoritative for a security decision that requires a server-side, persistent source of truth (the database counter). The vulnerability class is broken authentication (CWE-287), specifically improper validation of an authentication factor due to stale cached state.

The attack surface is the OTP verification endpoint in MISP's authentication flow. The precondition is that the target user has HOTP paper-token second-factor authentication enabled, the attacker holds a session in which the password step has already completed (the OTP step is pending), and the attacker has access to at least one HOTP token value (for example from a paper token list). Notably, the attacker does not need to forge an HMAC or break the HOTP algorithm; they only need any previously valid token value and a session that has not yet completed OTP verification.

No public proof-of-concept, Nuclei template, or exploit code is known for this CVE. The mechanism above is derived strictly from the NVD description. No CVSS score or vector was published by the assigning authority, so any CVSS metrics presented in this report are analytical inferences and should not be treated as authoritative.

Exploitation Scenarios

The attack chain for CVE-2026-103651 is at the authentication-logic layer and does not require bypassing cryptographic primitives. It is described below at the vulnerability-class level, consistent with the available technical detail.

1. Reconnaissance / target identification. The attacker identifies a MISP instance (MISP is a threat-intelligence sharing platform, typically exposed on internal or shared networks). They enumerate or obtain credentials sufficient to pass the first factor, or they capture an existing authenticated session where the password step has already been completed but the OTP step is still pending. The attacker confirms that the target account has HOTP (paper token) second-factor authentication enabled.

2. Triggering the flaw. The attacker submits a password to reach the OTP-pending state. At this point the server caches a counter value in the attacker's session. The attacker then submits a previously consumed HOTP token. Because verification compares the submitted token to the session-cached counter rather than the database counter, and that cached value is stale, the already-burned token validates.

3. Execution / payload method. No crafted payload is required beyond a valid session and a known HOTP token value. The attacker replays a token value they possess (for example from a leaked or captured paper token list). The verification logic accepts it and grants a second successful authentication.

4. Post-exploitation impact. The attacker obtains unauthorized access to the target MISP account, bypassing the second factor. The HOTP counter state is corrupted/rewound, which may invalidate subsequent legitimate tokens or enable further replays within the same or derived session state. From an authenticated MISP account, the attacker could access or manipulate the threat-intelligence data that account is authorized to view or modify.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the NVD description. Any specific endpoint, parameter, or function naming is intentionally omitted because none appears in the source data.

Impact Assessment

The primary impact is a bypass of the second authentication factor on MISP accounts that use HOTP paper tokens. Because CWE-287 (Improper Authentication) maps to confidentiality, integrity, and availability concerns, the practical effect is unauthorized account access and potential tampering with shared threat-intelligence data. The blast radius is limited to accounts with HOTP second-factor enabled and to attackers who already hold a session past the password step and possess at least one token value—meaning the attack is not remotely unauthenticated and does not break HOTP cryptography.

No official CVSS score or vector was assigned (NVD lists N/A). Analytical inference of the likely metric profile:

• Attack Vector (AV): Network-adjacent to Network — the OTP flow is reached over the network, but a valid session precondition applies.
• Attack Complexity (AC): High — requires a specific session state (password complete, OTP pending) and possession of a token value.
• Privileges Required (PR): Low — the attacker must already have passed the password step for the target account or otherwise control such a session.
• User Interaction (UI): None — the attacker drives the flow directly.
• Scope (S): Unchanged.
• Confidentiality (C): High — account access exposes MISP data.
• Integrity (I): Low to High — HOTP counter corruption and possible data manipulation.
• Availability (A): None to Low — legitimate users may be locked out if their token counter desynchronizes.

These subscores are analytical and are provided for prioritization only; treat them as non-authoritative given the absence of a published vector.

Detection Guidance

Sigma Rule

title: MISP HOTP Token Replay and Counter Rewind Attempt
id: 8f3b1c2a-7d4e-4a91-9b6c-2e5f0a1d3c77
status: experimental
description: Detects repeated successful or attempted HOTP (paper token) second-factor
  verifications for the same user/session, indicative of replay of a consumed token
  and counter rewind (CVE-2026-103651, MISP < 2.5.48).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103651
author: valtersit.com
date: 2026/01/01
tags:
  - attack.credential_access
  - attack.t1078
logsource:
  product: misp
  service: authentication
detection:
  selection_otp:
    event:
      - 'otp_auth'
      - 'hotp_verify'
      - 'user_login_otp'
  selection_success:
    outcome: 'success'
  timeframe: 15m
  condition: selection_otp and selection_success | count() by user > 2
falsepositives:
  - Legitimate retry after a mistyped token
  - Clock or counter resynchronization by an administrator
level: high

YARA Rule

rule CVE_2026_103651_MISP_HOTP_Replay_Indicator
{
    meta:
        description = "Heuristic indicator for MISP HOTP session-counter handling; flags session-stored counter variables rather than authoritative DB counter usage"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103651"
        date = "2026-01-01"
        severity = "high"

    strings:
        $otp1 = "hotp" ascii nocase
        $otp2 = "paper token" ascii nocase
        $otp3 = "one-time password" ascii nocase
        $sess1 = "Session" ascii
        $sess2 = "session" ascii

    condition:
        (any of ($otp*)) and 2 of ($sess*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103651 MISP HOTP Token Replay Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"otp"; nocase; http.uri; content:"login"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; sid:2026103651; rev:1; reference:cve,2026-103651; metadata:service http;)

Elastic Detection

sequence by user.name with maxspan=15m
  [ authentication where event.action in ("user-login") and event.outcome == "success" and user.name != null ]
  [ authentication where event.action in ("otp_auth","user-login-otp") and event.outcome == "success" ]
  [ authentication where event.action in ("otp_auth","user-login-otp") and event.outcome == "success" ]

Splunk SPL Query

index=auth sourcetype=misp:auth
(EventType=OTP_AUTH OR action=otp_auth OR action=user_login_otp)
| stats count as otp_successes values(src_ip) as src_ips by user, session_id
| where otp_successes > 1
| table _time user session_id otp_successes src_ips

Wazuh OSSEC Rule

<group name="misp,authentication,">
  <rule id="2026103" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">otp_auth|user_login_otp|hotp_verify</field>
    <field name="outcome">success</field>
    <description>CVE-2026-103651: MISP HOTP verification succeeded - possible token replay across a session.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Treat HOTP (paper token) second-factor verification as unreliable until a fix is available. Where possible, switch affected accounts to a TOTP or hardware-token second factor that does not depend on the vulnerable session-cached counter logic.
   • Invalidate and re-issue paper token lists for high-value accounts; assume any previously used HOTP token value is replayable under the described conditions.
   • Tighten session hygiene: shorten OTP-pending session lifetimes and force re-authentication of any session sitting in the password-completed/OTP-pending state.
   • Monitor for repeated successful HOTP verifications per user/session and for counter desynchronization reports from legitimate users (a signal that a counter rewind may have occurred).

2. Patch/upgrade steps.

   • The vulnerability is reported as fixed in MISP version 2.5.48 and later. Upgrade to 2.5.48 or the latest available release as soon as the vendor publishes a verified build, and re-validate the OTP flow after upgrade.
   • Note: no patch evidence was confirmed from tracked sources at the time of writing; verify patch availability directly against the vendor before relying on it.

3. Long-term hardening.

   • Enforce server-side, database-authoritative verification of one-time-password counters, and require that a successful OTP consumption atomically advances the persisted counter.
   • Adopt anti-replay controls: reject any token whose counter value is less than or equal to the last acknowledged value, and reject reuse within the same session.
   • Log both the session-cached and database counter values during OTP verification to detect divergence.
   • Review the OTP verification code path for other instances where session-scoped state is treated as authoritative for authentication decisions.

References

• NVD — CVE-2026-103651: https://nvd.nist.gov/vuln/detail/CVE-2026-103651
• MISP Project — official repository and release notes (version 2.5.48 fix reference): https://github.com/MISP/MISP
• MISP Project — official website and security advisories: https://www.misp-project.org
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• RFC 4226 — HOTP: An HMAC-Based One-Time Password Algorithm: https://datatracker.ietf.org/doc/html/rfc4226

No public PoC, Nuclei template, or exploit code is known. CISA KEV: NO. No threat actor campaigns or exploit-in-the-wild evidence identified.