CVE-2026-9084MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations
Updated under an hour ago ()
Does this affect you?
It affects misp. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.
- CVSS
- 6.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-287
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- CIRCL
- NVD analysis
- Awaiting Analysis
- Record last updated
- May 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
misp misp misp:misp (from the name) | from 2.5.0 through 2.5.37 | CNA record |
References
- https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.