CVE-2026-10861: MISP Open Redirect Vulnerability in Post-Login Flow

Technical summary

The vulnerability exists in UsersController::routeafterlogin() where the pre_login_requested_url session parameter is used to determine post-authentication redirect destinations. The application fails to enforce that the stored URL is a local path, allowing attackers to inject external URLs. CWE-601 (URL Redirection to Untrusted Site) describes this class of weakness. The patch mitigates the issue by decoding and parsing the redirect URL, then rejecting any URL that contains a scheme, host, user component, or is missing a local path. It also blocks protocol-relative URLs (//example.com) and backslash variants (/\example.com) that could bypass initial checks.

Business impact

Organizations running MISP for threat intelligence collaboration face increased risk of credential harvesting and lateral attack vectors. If MISP users are redirected to phishing pages or malware distribution sites after logging in, attackers gain a foothold that leverages the trust users place in their threat intelligence platform. For security teams that rely on MISP to coordinate incident response, this vulnerability could compromise the integrity of their intelligence workflow and create opportunities for social engineering attacks that appear to originate from internal infrastructure.

Affected systems

The vulnerability affects MISP installations (misp-project/misp). The exact version scope is not specified in available advisories; organizations should verify affected versions against the vendor advisory. Any MISP deployment exposed to unauthenticated users is vulnerable during the login process.

Exploitability

Exploitation requires user interaction (a victim must click a crafted link), but no special privileges are required on the attacker side. The attack surface is the MISP login page, which is typically public-facing. Crafting the malicious URL is trivial, and the technique is well-understood in web security. An attacker could distribute the link via email, chat, or social media; it would appear to direct to the legitimate MISP instance until after authentication occurs. This is classified as MEDIUM severity (CVSS 6.1) because it requires user interaction and causes low confidentiality and integrity impact, but does not enable denial of service or system compromise.

Remediation

Apply the vendor patch when available. The patch enforces strict URL validation by parsing the redirect destination and rejecting any URL with an external scheme, host, user info, or protocol-relative path. Organizations should verify the patched version against the official MISP advisory. Until patching, reduce exposure by restricting MISP access to authenticated networks, using a reverse proxy to enforce origin validation on redirect parameters, or educating users to verify the URL in their browser address bar after login.

Patch guidance

Consult the official MISP advisory for the specific patched version. Apply updates through the standard MISP update mechanism. After patching, verify that redirect behavior is restricted to local application paths (e.g., /events, /attributes) and external URLs are rejected. Test by attempting to craft a login URL with a malicious redirect parameter and confirm it is rejected or redirects locally.

Detection guidance

Monitor MISP logs for suspicious pre_login_requested_url session parameters that contain external domains or schemes (http://, https://, //, etc.). Look for patterns where legitimate users are redirected immediately after login, particularly to domains outside your organization. Web application firewalls or proxies can detect and block common open redirect patterns in URL parameters. Alert on any successful login followed by a redirect to an external IP or domain.

Why prioritize this

While the CVSS score is MEDIUM (6.1), prioritization depends on organizational context. MISP instances that are internet-facing and used by external threat intelligence partners should be patched urgently, as they represent a high-value target for adversaries seeking to compromise security teams. Internal MISP deployments behind authentication can be deprioritized, but external-facing instances should be treated as HIGH priority due to the social engineering risk and the sensitivity of threat intelligence workflows.

Risk score, explained

CVSS 6.1 (MEDIUM) reflects the requirement for user interaction, the lack of direct system compromise, and limited scope impact. The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-accessible, low attack complexity, no privileges required, user interaction required, changed scope (the attack crosses a trust boundary to an external domain), and low impact on confidentiality and integrity. The score appropriately captures that this is a social engineering vector rather than a direct technical exploit, but the reputational and operational damage in a threat intelligence context may warrant treating it as higher priority operationally.

Frequently asked questions