CVE-2026-107180

Executive Summary

CVE-2026-107180 is an authentication enforcement bypass in MISP (Malware Information Sharing Platform) affecting versions before 2.5.48. On instances configured with Security.otp_required, the mandatory TOTP enrolment guard applied only to standard browser requests, allowing an authenticated user to bypass forced second-factor setup by issuing non-browser requests (AJAX/XHR, REST API, .json URLs, restSearch, or automation actions). The result is that a user with valid primary credentials can retain full instance access indefinitely without ever enrolling in TOTP, nullifying the instance-level two-factor authentication policy.

Technical Analysis

MISP supports an instance-wide policy (Security.otp_required) that mandates all users enrol in Time-based One-Time Password (TOTP) two-factor authentication. The enforcement logic is implemented as a request guard that intercepts authenticated sessions and redirects users who have not yet completed TOTP enrolment to the enrolment page.

The defect is architectural: the guard was implemented only on the human-facing browser request path, which is capable of following HTTP redirects. Machine-readable request shapes — AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, and automation actions — cannot meaningfully follow a redirect to an HTML enrolment page. Rather than forcing these request types into a denial state, the guard skipped the check entirely for them. Consequently, an authenticated user who had not enrolled in TOTP could simply avoid the browser path and interact with the instance through any of these non-browser interfaces, retaining full access.

This is classified as CWE-287 (Improper Authentication). The bypass requires a pre-existing authenticated session or valid authentication credentials; it does not permit unauthenticated access. The vulnerability is therefore a policy-enforcement failure rather than a credential-theft primitive, though it materially weakens the security posture because the second factor that otp_required is designed to enforce is never applied.

Remediation occurred in two stages. The initial fix (commit 8deb0619e) added a guard specifically targeting AJAX requests. This was insufficient because other non-browser request shapes remained unguarded. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape while preserving the exemption for identities authenticated via API key, identified by the logged_by_authkey flag. The complete fix ships in MISP 2.5.48.

No CVSS vector was published in the supplied data (Score: N/A), and the advisory does not carry an EPSS score. The vector shown in METADATA is the analyst-derived assessment consistent with a network-reachable, low-privilege, no-user-interaction authentication bypass with high confidentiality and integrity impact and no direct availability impact.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-107180; the attack chain below is inferred from the vulnerability class and the vendor description. No specific function names, endpoints, or parameters beyond those stated in the description are asserted.

1. Reconnaissance / target identification. An attacker identifies a MISP instance configured with Security.otp_required (mandatory TOTP). This is typically reachable as a web application; instances are commonly exposed to internal or partner networks, and some are internet-facing.

2. Precondition — authenticated access. The attacker must already hold valid primary credentials for a MISP user account on the target instance. These may be obtained through credential reuse, phishing, a leaked password dump, or an insider scenario. At this stage the account has not completed TOTP enrolment, so on a browser session the user would be redirected to enrolment.

3. Bypass trigger. Instead of using the browser path, the attacker issues a non-browser request — an AJAX/XHR call, a REST API request, a .json format URL, a restSearch query, or an automation action. Because these request shapes cannot follow the enrolment redirect, the guard skips its check, and the request is processed without the user having enrolled in TOTP.

4. Post-exploitation impact. The attacker operates with full authenticated access to the instance without completing the required second factor. From there, they can read and modify events, attributes, and other MISP data, and use the server as a pivot into shared threat-intelligence infrastructure — all while defeating the organisation's stated two-factor policy.

Impact Assessment

Successful exploitation nullifies an instance-wide mandatory two-factor authentication control for any user who has not yet enrolled. Because the attacker already possesses valid primary credentials, this bypass converts a "stolen password" into full access without the second factor that the administrator explicitly configured to prevent exactly that outcome. This elevates the practical value of any credential leak affecting the instance.

Blast radius is bounded by the target instance: every user of an otp_required MISP instance below 2.5.48 is potentially affected if their credentials fall into attacker hands before enrolment completes. MISP often serves as a central hub for indicator sharing among partner organisations, so compromise can expose or corrupt shared intelligence and enable lateral trust abuse across partner instances.

Because no CVSS score or subscores were published in the supplied data, the analyst-derived vector in METADATA reflects a low-privilege (PR:L), network-reachable (AV:N) authentication bypass with no user interaction (UI:N), high confidentiality (C:H) and high integrity (I:H) impact, and no direct availability (A:N) impact. EPSS has not assigned a score, so no exploit-probability estimate is available. CISA KEV does not list this CVE. The change is classified as UNPATCHED by the tracked sources because no patch evidence was received, though the vendor description identifies MISP 2.5.48 as the fixed version.

Detection Guidance

Sigma Rule

title: MISP Forced-TOTP Enrolment Bypass via Non-Browser Requests
id: 9b2f7c1a-4e8d-4c6b-b1f0-misp-totp-bypass
status: experimental
description: Detects authenticated MISP requests to non-browser interfaces (AJAX/XHR, REST API, .json, restSearch, automation) issued by users who have not completed mandatory TOTP enrolment on an otp_required instance.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107180
author: valtersit.com
date: 2026-01-01
logsource:
  product: misp
  service: web
detection:
  selection_request_shape:
    cs-uri-query|contains:
      - '/restSearch'
      - '/users/login'
    cs-uri|endswith:
      - '.json'
  selection_automation:
    cs-uri-query|contains:
      - 'automation'
      - 'export'
  selection_xhr:
    cs-headers|contains: 'X-Requested-With: XMLHttpRequest'
  condition: (selection_request_shape or selection_automation or selection_xhr)
level: high
falsepositives:
  - Legitimate API clients authenticated via API key (logged_by_authkey), which are exempt from the guard.
  - Normal automated exports performed by already-enrolled users.

YARA Rule

rule MISP_TOTP_Enrolment_Guard_Bypass_Indicators
{
    meta:
        description = "Detects MISP request-handling artefacts that indicate use of non-browser request shapes associated with the forced-TOTP enrolment bypass. Informational/triage rule; not a definitive detector."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107180"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-107180"

    strings:
        $a = "otp_required" ascii wide nocase
        $b = "logged_by_authkey" ascii wide nocase
        $c = "/restSearch" ascii wide
        $d = "XMLHttpRequest" ascii wide
        $e = "TOTP" ascii wide nocase

    condition:
        filesize < 5MB and
        (uint16(0) == 0x3C3F or uint16(0) == 0x7B7B) and
        any of ($a, $b, $c) and
        any of ($d, $e)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107180 Possible MISP Forced-TOTP Enrolment Bypass - JSON/REST request by unenrolled user"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/restSearch"; http.uri; content:".json"; nocase; http.header; content:"X-Requested-With"; nocase; classtype:attempted-user; reference:cve,CVE-2026-107180; sid:2026107180; rev:1;)

Elastic Detection

// Detects authenticated MISP requests to JSON/REST or restSearch endpoints
// for users flagged as not having completed TOTP enrolment.
sequence by user.id with maxspan=1m
  [ authentication where event.category == "authentication" and event.outcome == "success" and user.id != null ]
  [ http where http.request.method in ("GET", "POST")
      and (http.request.uri : "*.json" or http.request.uri : "*restSearch*" or http.request.uri : "*automation*")
      and not user.id : null ]

Splunk SPL Query

index=web sourcetype=misp OR sourcetype=access_combined
| eval uri_lower = lower(uri)
| where match(uri_lower, "\.json(\?|$)") OR match(uri_lower, "restsearch") OR match(uri_lower, "automation") OR match(uri_lower, "export")
| search user!="" user!="-"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by user src_ip
| where count > 0
| sort -count

Wazuh OSSEC Rule

<group name="misp,web,authentication_bypass,">
  <rule id="107180" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>.json|restSearch|automation|export</url>
    <description>CVE-2026-107180: Possible MISP forced-TOTP enrolment bypass via non-browser request shape ($(url))</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>cve_2026_107180,pci_dss_10.6.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor description identifies MISP 2.5.48 (commits 8deb0619e and 6b527ba6e) as the fix; however, no patch evidence was received from any tracked source, so this must be independently verified before relying on it.

1. Immediate mitigations. Restrict access to MISP instances so that only trusted networks and users can reach them, reducing the population of attackers who can abuse a valid session. Enforce MISP API-key authentication for all automation and non-browser clients so they are exempt through logged_by_authkey rather than through the bypass path. Enforce network-level access controls (VPN, IP allowlisting) and monitor for unusual non-browser request volume. Because the bypass requires valid primary credentials, harden credential hygiene: rotate credentials, enforce strong passwords, and monitor for credential stuffing.

2. Patch / upgrade steps. Upgrade to MISP 2.5.48 or later, which according to the vendor description includes the broadened guard covering all non-browser request shapes. Verify the deployed build after upgrade and re-test TOTP enforcement from an unenrolled account using AJAX, REST, .json, restSearch, and automation request types to confirm the guard now applies. Where upgrade is not immediately possible, restrict non-browser interfaces at the reverse proxy to trusted API-key holders only.

3. Long-term hardening. Make Security.otp_required enforcement request-shape agnostic so that any unenrolled, non-API-key authenticated session is denied rather than redirected or skipped. Continuously audit authentication and authorisation guards for alternate request paths (JSON, XML, AJAX, API) that may bypass browser-oriented controls. Enforce the logged_by_authkey exemption narrowly and log all exemptions. Apply defence in depth: network segmentation, centralised logging of MISP access, and periodic verification that mandated MFA policies are actually enforced after enrolment, not merely during enrolment.

References

• NVD — CVE-2026-107180: https://nvd.nist.gov/vuln/detail/CVE-2026-107180
• MISP Project — official repository and release notes for 2.5.48: https://github.com/MISP/MISP
• MISP Project documentation — authentication and two-factor (TOTP) configuration guidance: https://misp.github.io/MISP/
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. No CISA KEV listing and no reported in-the-wild exploitation campaigns are associated with this vulnerability in the supplied data.