CVE-2026-92003 — MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Back Back to CVE browser

MEDIUM

MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Published Sep 15, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.57%

Description

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Two API authentication failure branches wrote directly to the Log model:

- API requests with no authentication key; - requests supplying an API key with an incorrect length

Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.

Version affected: ≤2.5.45

Affected products

Vendor MISP Product MISP Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <2.5.46

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MISP

n/a

Version	Status	Constraints
0	affected	<2.5.46

Remediation

Vendor solution

The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.