CVE-2026-92003 — MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

CVE-2026-92003

MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion PUBLISHED

Description (CNA)

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45

Affected (CNA)

Vendor / product	Versions
MISP / MISP	affected 0 before 2.5.46

CWE

CWE-770, CWE-400

References

https://github.com/MISP/MISP/commit/2bf887433

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.