CVE-2026-92003 Details
Description
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45
A vulnerability exists in MISP versions through 2.5.45, where the authentication failure logging throttle is not consistently applied. This issue affects two API authentication failure scenarios: requests without an authentication key and those with an incorrectly sized API key. Unlike other authentication failures, these cases bypass the logging throttle, allowing multiple authentication failure entries to be recorded.
Users can upgrade to MISP version 2.5.47, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/2bf887433 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CIRCL |
| CWE-770 | Allocation of Resources Without Limits or Throttling | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | <= 2.5.45 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | CIRCL |