MISP: TOTP code replay allows duplicate two-factor authentication
Summary
MISP before 2.5.48 accepts a valid TOTP one-time code more than once within its 30-second validity period during the two-factor login. An attacker who captures a legitimate code during a user's login, for example through network interception, shoulder surfing or a compromised client, can replay it to open a second session as that user. Successful exploitation grants access to threat-intelligence data and administrative functions available to the targeted account.
Affected
- MISP versions before 2.5.48
- Installations where users have TOTP-based two-factor authentication enabled
Fixed in
- MISP 2.5.48 (vendor fix in commit a020fa47b); the latest release is recommended
Workaround
- No vendor workaround known; apply the patched release.
- Interim: restrict access to the MISP web interface to trusted networks or VPN.
Exploitation
- CCB reports no evidence of active exploitation in the wild.
- CISA SSVC lists exploitation as none and automatable as yes.
- No public proof of concept found; CISA KEV listing not verified.
Our recommendation
- If you run MISP, upgrade to the latest release (at least 2.5.48).
- Check accounts with two-factor authentication for unexpected logins and sessions.
- Restrict access to the MISP interface to trusted networks.
- Confirm the NVD status and any CISA KEV listing directly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MISP commit a020fa47b github.com
- OSV: CVE-2026-103655 osv.dev
- CCB advisory on MISP TOTP vulnerability ccb.belgium.be
- MISP releases github.com
- CVEDetails: MISP vulnerability list www.cvedetails.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:42.
Original description (NVD)
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user. Preconditions: - The target user has TOTP-based two-factor authentication enabled. - The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client). - The replay must occur within the TOTP validity period. Security impact: - Unauthorized account access by replaying a captured one-time code. - Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user. Affected versions: <v2.5.48.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.