CVE-2026-92003 — MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log mod…
Published: 2026-09-15 · CVSS: 6.9 · CVSS 4.0
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7