CVE-2026-107276

Executive Summary

CVE-2026-107276 is a race condition (CWE-362) in the email-based one-time password (OTP) login flow of MISP (Malware Information Sharing Platform). On instances where email OTP login is enabled, concurrent submission of two HTTP requests carrying the same valid OTP can result in both requests successfully authenticating and establishing separate sessions, violating the one-time-use guarantee of the OTP. The vulnerability affects MISP versions below 2.5.48 and, at the time of writing, has no confirmed vendor patch, no CVSS base score assigned, no EPSS score, and no public proof-of-concept or exploit code.

Technical Analysis

The flaw resides in the non-atomic handling of the OTP value within MISP's email-based OTP login flow. According to the NVD description, the OTP value is processed in three distinct, non-atomic steps: it is read from a shared store, validated, and then deleted. Because these operations are not performed atomically (for example, under a lock or via a compare-and-delete primitive), a TOCTOU (time-of-check to time-of-use) window exists between the validation step and the deletion step.

When an attacker submits two HTTP POST requests containing the same valid OTP in close temporal proximity, the following sequence can occur:

1. Request A reads the OTP value from the shared store.
2. Request B reads the same OTP value from the shared store before Request A's deletion takes effect.
3. Request A validates the OTP and proceeds to establish a session.
4. Request B validates the same OTP and also proceeds to establish a session.
5. Request A deletes the OTP from the store (too late to affect Request B, which has already read and validated it).

The root cause is the absence of an atomic read-validate-delete operation. In a correct implementation, the OTP should be consumed atomically — for example, via a single atomic compare-and-swap or delete-on-read operation that guarantees only one request can successfully validate a given OTP value. The concurrency window is bounded by the latency between the read and the delete operations; on a system under load or with database/backend latency, this window can be wide enough to be reliably exploitable.

The attack surface is the HTTP-facing authentication endpoint that processes email OTP submissions. This is a network-reachable component (AV:N in the inferred vector), though exploitation requires a high degree of timing precision and a valid OTP (AC:H). No specific endpoint path, parameter name, function name, or class name is provided in the NVD description, so those details cannot be stated with confidence. The vulnerability class is a classic concurrency/race condition affecting an authentication control.

It is important to note that this vulnerability does not allow an attacker to bypass authentication without a valid OTP. Instead, it weakens the one-time-use property of the OTP, meaning a single intercepted or socially engineered code can yield more than one authenticated session. This distinguishes it from authentication bypass vulnerabilities; the attacker must already possess a valid, unexpired OTP.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-107276. The attack chain below is inferred from the vulnerability class (race condition in a non-atomic read-validate-delete OTP flow) and the preconditions stated in the NVD data. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / Target Identification: The attacker identifies a MISP instance that has email OTP login enabled. This can be determined by observing the login flow, which presents an OTP challenge after primary credential submission, or by fingerprinting the MISP web interface. Shodan or similar services can be used to enumerate internet-facing MISP instances, though the attacker must then confirm that email OTP is enabled.

2. Credential / OTP Acquisition: The attacker must possess a valid, unexpired OTP. Per the NVD description, this could be obtained via email interception (e.g., compromise of the email account or transport) or social engineering. This step is a precondition, not part of the race condition itself.

3. Triggering the Race Condition: The attacker submits two HTTP POST requests carrying the same valid OTP in close temporal proximity. The mechanism exploits the non-atomic read-validate-delete sequence: both requests read the OTP value from the shared store before either deletion takes effect, and both proceed to validate it successfully. Achieving the necessary concurrency may require parallel request tooling or scripted simultaneous submission, and may be tuned by varying request timing, connection reuse, or load.

4. Post-Exploitation Impact: If the race is won, both requests establish authenticated sessions. The one-time-use guarantee of the OTP is violated, yielding two authenticated sessions from a single code. This weakens the authentication control and can facilitate unauthorized access when the OTP is shared or intercepted. The attacker gains whatever privileges the authenticated account possesses within MISP. Note that MISP is a threat intelligence sharing platform, so a compromised account may expose sensitive intelligence data, indicators, and sharing group memberships.

The reliability of this attack depends on the width of the race window, which is not quantified in the available data. No information is available regarding exploit-in-the-wild activity, and no threat actor campaigns have been associated with this CVE.

Impact Assessment

The primary impact is a violation of the one-time-use property of email OTPs, enabling a single valid OTP to establish two authenticated sessions. This weakens an authentication control that is often deployed specifically to defend against credential theft and replay.

Because no CVSS base score or vector is provided by the data source, the following subscores are inferred from the vulnerability class and stated preconditions and are presented for contextual risk assessment only:

• Attack Vector (AV:N): The flaw is triggered via HTTP requests to a network-reachable login endpoint.
• Attack Complexity (AC:H): Exploitation requires precise timing and a valid OTP, making success non-trivial.
• Privileges Required (PR:N): The attacker does not need prior authentication, but does need a valid OTP.
• User Interaction (UI:N): No direct victim interaction is required beyond the OTP having been issued.
• Scope (S:U): The impact remains within the MISP application's security authority.
• Confidentiality (C:L): A second authenticated session may expose data accessible to that account.
• Integrity (I:L): Actions performed in the second session could alter platform data.
• Availability (A:N): No direct availability impact.

Business Impact: MISP is widely used by security operations centers, incident response teams, and threat intelligence sharing communities. Unauthorized establishment of a second session could expose sensitive indicators of compromise, sharing group relationships, organizational attribution data, and internal analysis. Because MISP instances are often federated, compromise of one account can expose data shared by partner organizations, amplifying the blast radius beyond a single organization.

Blast Radius: Limited to MISP instances with email OTP login enabled and where an attacker has obtained a valid OTP. The confidentiality and integrity impact is scoped to the privileges of the compromised account.

Affected Systems: MISP versions below 2.5.48.

Detection Guidance

Sigma Rule

title: MISP Email OTP Race Condition - Concurrent Authentication Success
id: 3f9a7c2e-1b4d-4e8a-9c6f-2d5e8a1b7c3f
status: experimental
description: Detects concurrent successful MISP email-OTP authentications using the same OTP within a short time window, indicative of CVE-2026-107276 race condition exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107276
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1078
  - attack.initial_access
logsource:
  product: misp
  service: authentication
detection:
  selection:
    event:
      - 'otp_login_success'
      - 'auth_success'
    auth_method: 'email_otp'
  timeframe: 10s
  condition: selection | count() by src_ip, user > 1
fields:
  - src_ip
  - user
  - session_id
  - timestamp
falsepositives:
  - Legitimate user re-authenticating after session error
  - Load balancer retries with disabled idempotency
level: high

YARA Rule

rule CVE_2026_107276_MISP_OTP_Race_Indicator
{
    meta:
        description = "Detects MISP source code patterns indicative of non-atomic OTP read-validate-delete handling (CVE-2026-107276). Low-confidence heuristic for MISP deployments."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107276"
        cve = "CVE-2026-107276"

    strings:
        $otp_a = "otp" ascii nocase
        $otp_b = "one-time" ascii nocase
        $validate = "validate" ascii nocase
        $delete = "delete" ascii nocase
        $session = "session" ascii nocase

    condition:
        (uint32(0) == 0x3C3F7068) and // <?php header
        filesize < 2MB and
        all of ($otp_a, $otp_b) and
        any of ($validate) and
        any of ($delete) and
        any of ($session)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107276 MISP Email OTP Race Condition Attempt - Rapid Duplicate OTP Submission"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"otp"; nocase; threshold:type both, track by_src, count 2, seconds 5; classtype:attempted-user; sid:2026107276; rev:1; reference:cve,CVE-2026-107276; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ authentication where event.outcome == "success" and
      misp.authentication.method == "email_otp" ]
  [ authentication where event.outcome == "success" and
      misp.authentication.method == "email_otp" ]

Splunk SPL Query

index=misp sourcetype=misp:auth event=otp_login_success
| stats count as success_count, dc(session_id) as session_count, values(session_id) as sessions
    by user, src_ip, otp_hash
| where success_count > 1 AND session_count > 1
| sort - success_count
| table _time, user, src_ip, otp_hash, success_count, session_count

Wazuh OSSEC Rule

<group name="misp,authentication,">
  <rule id="100276" level="12" frequency="2" timeframe="10">
    <decoded_as>misp</decoded_as>
    <field name="event">otp_login_success</field>
    <description>CVE-2026-107276: Multiple successful MISP email-OTP authentications using the same OTP - potential race condition exploitation</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_failed,pci_dss_10.2.4,gpg13_7.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Where email OTP login is not strictly required, disable it and rely on alternative authentication enforcement (e.g., TOTP-based MFA if supported by the instance).
   • Ensure MISP WebAuthn or TOTP-based multi-factor authentication offering atomic validation/deletion in shared store (e.g., Redis GETDEL-style atomic delete-on-read) is enforced and prioritized; this does not remediate the OTP flow but removes dependence on the affected control.
   • Apply rate limiting on the OTP submission endpoint and serialize OTP validation requests per user (for example, at a reverse proxy) to shrink or eliminate the race window. Ensure only one request per OTP/user is processed at a time.
   • If email OTP must remain enabled, enforce high-entropy, short-lived OTPs and strictly limit the number of independent sessions per account, invalidating prior sessions on new login.

2. Patch / Upgrade Steps:

   • No vendor patch has been confirmed through tracked sources. Monitor the MISP project's official release notes and security advisories for a fix; the description indicates affected versions are below 2.5.48, but patch evidence is absent, so do not assume version 2.5.48 remediates this issue without confirmation from the vendor.
   • Until an official fix is available, do not expose MISP login interfaces to untrusted networks; restrict access via VPN, IP allowlists, or zero-trust gateways.
   • Implement application-layer serialization of OTP validation (e.g., per-user advisory locks) as a compensating control if custom patching is feasible.

3. Long-Term Hardening:

   • Replace non-atomic read-validate-delete OTP logic with atomic consume-on-read primitives (e.g., atomic compare-and-delete or delete-on-read in the shared store) in custom integrations/locally maintained forks.
   • Strengthen session-binding controls so that a second in-flight request cannot independently establish an authenticated session (e.g., single-use session tokens issued only once per OTP consumption event).
   • Log and alert on multiple successful authentications for the same user within short windows, and correlate by OTP identifier or session identifier where available.
   • Conduct code review of authentication flows for other TOCTOU race conditions and adopt concurrency-safe design patterns as standard.

References

• NVD — CVE-2026-107276: https://nvd.nist.gov/vuln/detail/CVE-2026-107276
• CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'): https://cwe.mitre.org/data/definitions/362.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• MISP Project — official repository and release notes: https://github.com/MISP/MISP
• MISP Project — security advisories and issue tracker: https://github.com/MISP/MISP/security

No exploit-in-the-wild evidence, public proof-of-concept, or associated threat actor campaign was identified for CVE-2026-107276 at the time of writing. CISA KEV status: not listed.