CVE-2026-85216 is an authentication bypass in the LDAP and LinOTP login components of MISP (CVSS 9.8, critical). Empty or non string credentials could reach the backend and pass. The upstream commit rejects them, so update MISP. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says MISP custom LdapAuthenticate and LinOTPAuthenticate components replaced CakePHP's FormAuthenticate but did not repeat its credential checks. The weakness is listed as CWE-521, weak password requirements.
In the LDAP path, an attacker who knew a valid directory user's email could submit an empty password, and an LDAP server that accepts unauthenticated binds might return success. The record also describes a LinOTP and mixed authentication path where an empty password could match a local hash. The fix is the upstream commit titled to reject empty and non string credentials. The record does not list a release number, so check the MISP release notes for the build that contains it. The record is not in the CISA KEV catalog.
How to check if you're exposed
Find out whether you use LDAP or LinOTP authentication in MISP, in the authentication settings. If you do not, this flaw does not apply to your login path. Next, check whether your LDAP server allows unauthenticated binds, since the record ties the LDAP issue to that setting. Compare your MISP version with the release that includes commit 0ee058548.
What to do now
- Update MISP to a release that contains the upstream fix.
- Check your LDAP server and disable unauthenticated binds if it allows them.
- Review MISP accounts created through LDAP for empty local password hashes.
- Review administrator accounts and recent logins for anything unexpected.
- Limit network access to the MISP web interface to the teams that use it.
Why it matters
The bug is a missing check at a trust boundary. The framework's own form login rejected empty values, but the replacement components did not. Under the LDAP protocol, a bind with a name and an empty password is treated as an anonymous bind on many servers, and that can look like success.
MISP holds threat intelligence that organizations share, so an impersonated administrator is a real concern. Validate credentials before they reach the identity backend.
Quick check
Does this affect local password logins?
The record describes the LDAP and LinOTP components, and a fallback case when mixed authentication is on. Plain local accounts are not described as affected.
Sources
Last reviewed: 19 October 2026.
