CVE-2026-103655

Executive Summary

CVE-2026-103655 is an authentication weakness in MISP (Malware Information Sharing Platform) in which a TOTP one-time code can be accepted more than once during its time-based validity window. The flaw resides in the user login flow where the TOTP code is verified as a second authentication factor, and the system never recorded whether a given TOTP period had already been consumed. Any organization running a MISP instance below version 2.5.48 with TOTP-based 2FA enabled is exposed to replay-based account takeover if an attacker can observe a legitimate code during the validity period.

Technical Analysis

The vulnerability is classified as CWE-294 (Authentication Bypass by Capture-replay). The root cause is that MISP's TOTP verification process treats a valid one-time code as valid for the entire duration of its time window (typically 30 seconds) rather than invalidating it upon first successful use. Because the application does not record whether a given TOTP period has already been consumed, the same numeric code remains acceptable for repeated authentication attempts until the TOTP time step advances.

The attack surface is the user login flow where the TOTP code is submitted as the second authentication factor. The flaw does not weaken the TOTP algorithm itself — HMAC-based one-time password derivation remains intact — but breaks the "one-time" property at the application layer. A correctly computed TOTP value that a legitimate user submits during a real login therefore continues to satisfy the verification check for a second, attacker-originated session as long as the replay is performed before the code's time window expires.

Two preconditions constrain exploitation. First, the targeted account must have TOTP-based two-factor authentication enabled; accounts without 2FA are unaffected by this specific logic flaw. Second, the attacker must be positioned to observe or intercept the code during a legitimate login. That position may be obtained through network-level interception, shoulder surfing, or a compromised client endpoint. Replay must occur within the validity period. The absence of public exploit code and the requirement for code interception are reflected in the assessed attack vector (AC:H), while the UI:R component reflects the need to observe a legitimate user interaction.

No function names, class names, URL endpoints, API paths, or specific parameters beyond those described above are available from the provided intelligence; the analysis therefore remains at the vulnerability-class level.

Exploitation Scenarios

1. Reconnaissance / target identification: The attacker identifies a MISP instance running a version below v2.5.48 whose target user has TOTP-based 2FA enabled. This can be established by observing login flows, fingerprinting the MISP web interface, or from prior knowledge of the target environment.

2. Triggering the flaw class: The attacker monitors for a legitimate authentication event — via network-level interception, shoulder surfing, or a compromised client — and captures the numeric TOTP code as the victim submits it during login. The attacker must then replay the captured code within the same TOTP validity period (typically 30 seconds). No modification of the code is required; because the server does not record that the time step was already consumed, verification succeeds a second time.

3. Payload / execution method (vulnerability class): This is an authentication replay, not a code-injection or memory-corruption attack. The execution method is re-submission of the captured one-time code to the same login flow's TOTP verification step before the window closes. No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-294).

4. Post-exploitation impact: Successful replay authenticates a second session as the targeted user. The attacker gains access to whatever data and functions that user can reach — including threat-intelligence data the user can view and administrative functions where the user holds them. The attacker operates under a valid account identity, making activity harder to distinguish from legitimate use.

Impact Assessment

Successful exploitation results in unauthorized account access by replaying a captured one-time code, leading to potential compromise of threat-intelligence data and any administrative functions accessible to the targeted user. MISP is a sharing platform, so a compromised analyst or administrator account can expose sensitive indicators of compromise, sharing-group relationships, and enrichment data; where an admin account is affected, the blast radius extends to configuration and user management functions within that instance. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N reflects high confidentiality and integrity impact, high attack complexity due to the interception requirement, and no user privileges or additional authentication required to initiate the network-based attack. Scope is unchanged (S:U). Per the provided data, no CVSS base score and no EPSS score have been published; CISA KEV status is NO, and no public PoC, Nuclei template, or exploit code is known. Exploitation is assessed as limited by the short validity window and the need for a privileged observation position, but the impact when achieved is significant.

Detection Guidance

Sigma Rule

title: MISP TOTP Second-Factor Code Replay Attempt
id: 7f9c2a10-4c3e-4b8d-9a1e-misp103655
status: experimental
description: Detects repeated successful TOTP second-factor validation for the same user within a short window, indicative of one-time code replay against MISP (CVE-2026-103655).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103655
author: valtersit.com
date: 2026/01/01
logsource:
  product: misp
  service: authentication
detection:
  selection_login:
    event.action: 'user_login'
    event.outcome: 'success'
  selection_totp:
    misp:
      auth_factor: 'totp'
  timeframe: 60s
  condition: selection_login and selection_totp | count() by user.name > 1
falsepositives:
  - Legitimate rapid re-login by the same user across multiple browser tabs
  - Double submission due to client-side retry logic
level: high
tags:
  - attack.t1078
  - cve.2026.103655

YARA Rule

rule CVE_2026_103655_MISP_TOTP_Replay
{
    meta:
        description = "Detects indicators of MISP TOTP one-time code replay logic flaw (CVE-2026-103655)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103655"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-103655"
        severity = "high"

    strings:
        $totp = "totp" ascii nocase
        $code = "totp_code" ascii nocase
        $verify = "verify" ascii nocase
        $login = "login" ascii nocase
        $misp = "MISP" ascii

    condition:
        uint32be(0) == 0x504B0304 and
        any of ($totp, $code) and
        any of ($verify, $login) and
        $misp
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103655 MISP TOTP Second-Factor Code Replay Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"login"; nocase; http.request_body; content:"totp"; nocase; threshold:type both, track by_src, count 2, seconds 30; reference:cve,2026-103655; classtype:attempted-replay; sid:2026103655; rev:1;)

Elastic Detection

sequence by user.name with maxspan=60s
  [ authentication where event.action == "user_login" and event.outcome == "success" and misp.auth_factor == "totp" ]
  [ authentication where event.action == "user_login" and event.outcome == "success" and misp.auth_factor == "totp" ]

Splunk SPL Query

index=misp sourcetype=misp:auth action=user_login outcome=success auth_factor=totp
| bin _time span=60s
| stats count values(src_ip) as src_ips values(user) as users by _time user
| where count > 1
| table _time user count src_ips users

Wazuh OSSEC Rule

<group name="misp,authentication,cve-2026-103655">
  <rule id="103655" level="12" frequency="2" timeframe="60">
    <decoded_as>json</decoded_as>
    <field name="action">user_login</field>
    <field name="outcome">success</field>
    <field name="auth_factor">totp</field>
    <same_field>user</same_field>
    <description>CVE-2026-103655: repeated successful TOTP second-factor logins for the same MISP user within 60s - possible one-time code replay</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Enforce single-use semantics for TOTP at the MISP application layer: track and persist consumed TOTP time steps per user so a given period cannot be accepted twice. This is a compensating control until an official fix exists.
• Shorten the effective TOTP validity window where configurable, reducing the replay opportunity.
• Enforce encrypted transport for all login traffic and restrict access to the MISP login interface to trusted networks or VPN to reduce interception opportunities.
• Monitor for the repeated success pattern covered in the Detection Guidance above and alert on it.

2. Patch / upgrade steps:

• No patch evidence is available from any tracked source. If an upstream MISP fix is released, upgrade to the first version at or above v2.5.48 that contains the TOTP replay fix, and verify the fix in a staging environment before production rollout.
• Where a vendor fix does not exist, apply the compensating single-use TOTP control cited above and document the residual risk.

3. Long-term hardening:

• Prefer phishing-resistant second factors (hardware security keys / WebAuthn) over TOTP, eliminating code-interception replay entirely.
• Log and retain authentication events sufficient to reconstruct TOTP validation attempts and detect anomalies.
• Educate users against code observation and shoulder surfing, and harden client endpoints against compromise.

References

• NVD — CVE-2026-103655: https://nvd.nist.gov/vuln/detail/CVE-2026-103655
• CWE-294 (Authentication Bypass by Capture-replay): https://cwe.mitre.org/data/definitions/294.html
• MISP project: https://www.misp-project.org/
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• No known threat actor campaigns or exploit-in-the-wild evidence was identified in the provided data; CISA KEV status is NO and no public PoC is available.