CVE-2026-10611 is a critical (CVSS 10.0) authentication bypass in MISP when LDAP mixed authentication is combined with OTP enforcement. Someone with valid primary credentials may reach the application without completing the OTP step. The fix is in the MISP repository. Update MISP and check your two settings.
What's affected
The record describes a configuration condition: LdapAuth.mixedAuth set to true and Security.require_otp set to true. In those deployments, users authenticated through an authentication plugin such as LDAP can have their session set up before the normal login flow enforces the OTP challenge.
The record points to a fix commit in the MISP repository (39b3cb1) but names no release number. Check MISP's release notes to find the first release that contains it, and confirm it before relying on a version.
How to check if you're exposed
Check the two settings in the MISP administration area under Server Settings, searching for mixedAuth and require_otp. If both are true, you are in the described condition.
Then check which version or commit you run, and whether it includes the fix commit. In a git checkout:
cd /var/www/MISP
git log --oneline | head -5
git branch --contains 39b3cb15aac4318afdd2ab63b96c2eac12b271fe
An empty list means your checkout does not contain the fix.
What to do now
- Update MISP to a release or commit that includes the fix, and confirm it in the release notes.
- If you cannot update yet, consider turning off mixed LDAP authentication, or restrict access to MISP to a trusted network or VPN.
- Review recent logins for accounts that authenticated through the plugin without an OTP event in your logs.
- Make sure the second factor is also enforced at a reverse proxy or identity provider if you can.
- Re-test after the update: sign in with valid credentials and confirm you are stopped at the OTP page.
Why it matters
The weakness is classed as CWE-287 (improper authentication). The flaw is one of ordering. The plugin path establishes the session early, in the application's beforeFilter stage, before the OTP step has run. After that, a user who goes straight to another URL is already signed in.
Sequencing bugs like this appear whenever a second factor is bolted onto a login flow that has more than one entry. Every route to a session has to pass the same checks, so test each login path, not only the default one.
The record scores it 10.0 with a changed scope, but its description requires valid primary credentials and a specific configuration. The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Am I affected if I use only local MISP accounts?
The record ties the issue to deployments with plugin-based authentication such as LDAP, mixed authentication on, and OTP required. Check your own settings against that.
Sources
Last reviewed: 19 October 2026.
