CVE-2026-85237 is a high severity authentication flaw in MISP. The email one-time password step did not limit verification attempts, so someone who already had a user's primary credentials could keep guessing the code. The patch adds attempt counting and lockout. Update MISP to a build that includes it.
What's affected
- Product: MISP (misp-project), the
email_otp()authentication endpoint. - Affected and fixed versions: the record names no release numbers and points to one upstream commit, 8658062ea. Check the MISP release notes to see which tag includes it.
- Condition: the attacker has reached the OTP stage, for example after supplying correct primary credentials, and email OTP is the second factor.
Severity in the record: High, CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Weakness class: CWE-307 (Improper Restriction of Excessive Authentication Attempts).
How to check if you're exposed
- Check your MISP version on the Diagnostics page, or in
VERSION.jsonin the install directory. - Confirm whether email based OTP is enabled for your users. If you use another second factor, the exposure is smaller.
- Look at authentication logs for runs of failed OTP attempts against one account, especially followed by a success.
- Check whether the commit above is in your tree with
git log --onelinein the install directory, if you update from git.
What to do now
- Update MISP to a build that includes commit 8658062ea or a release that contains it.
- Review accounts whose logs show repeated failed OTP attempts, and reset their credentials and sessions.
- Where possible, move users to an authenticator app or a hardware key instead of email codes.
- Make sure primary passwords are unique and strong, since the flaw only matters once they are known.
- Alert on bursts of failed second factor attempts.
Why it matters
A second factor only helps if guessing it is hard. A six digit code has a million possibilities, which is small if an attacker can try without limit. MISP already had a brute force protection for passwords, but the OTP check did not use it. That is CWE-307, improper restriction of excessive authentication attempts.
The design made it worse. The record explains the code was tied to the user, not to one pending login, so several sessions could guess against the same valid code at once. The patch counts failures per user, rejects further tries after a threshold, invalidates the active code, blocks fresh codes for blocklisted users, and compares in constant time. No exploitation in the wild is claimed in the record.
Quick check
Does an attacker need the password first?
Yes. The record says the attacker must have reached the OTP stage, for example by providing the user's primary credentials.
Sources
Last reviewed: 18 October 2026.
