CVE-2026-56425: Critical OAuth 2.0 Flaws in MISP Azure Active Directory Authentication

Technical summary

The vulnerability stems from multiple implementation gaps in the OAuth 2.0 authorization code flow. Session identifiers—normally long-lived credentials—are reused as the OAuth state parameter, violating the principle that state values should be short-lived and single-use. The lack of session ID rotation post-authentication enables session fixation attacks. The state parameter itself is not implemented as a cryptographically random nonce with single-use semantics, weakening CSRF defenses and allowing state reuse or replay. The plugin does not enforce HTTPS on OAuth redirect URIs, permitting authorization codes and access tokens to traverse networks in cleartext. Finally, OAuth error responses containing attacker-supplied parameters are logged verbatim without sanitization or length limits, enabling log injection and audit record corruption. The fix introduces dedicated random state values, single-use validation, constant-time comparison, post-login session rotation, HTTPS-only redirect enforcement, and sanitized logging.

Business impact

Successful exploitation could grant attackers unauthorized access to MISP instances and the intelligence data they contain. Session hijacking via leaked or reused identifiers means an attacker can impersonate legitimate users without knowing their passwords. Log injection attacks could corrupt audit trails, hindering forensic investigation and compliance reporting. For organizations using MISP for threat intelligence sharing, a compromised instance could expose sensitive indicators, sources, and analysis to adversaries. The combination of authentication bypass and audit trail tampering creates both immediate operational risk and downstream compliance exposure.

Affected systems

The AAD Authentication Plugin for MISP is affected. This plugin is used when MISP instances are configured to authenticate users via Azure Active Directory using OAuth 2.0. Installations using alternative authentication methods (LDAP, local database, SAML) are not directly impacted. The scope includes any MISP deployment with AAD OAuth integration enabled. Organizations should verify which MISP instances in their environment use this authentication method.

Exploitability

The vulnerability requires user interaction—specifically, a victim must be tricked into clicking a malicious link that initiates the OAuth flow or be redirected through an attacker-controlled intermediate. However, once that interaction occurs, the underlying flaws are reliably exploitable. The use of session IDs as state values and the absence of HTTPS enforcement are particularly problematic in network environments where traffic can be intercepted. The lack of CSRF protection via proper nonce handling and state validation means attackers can reliably forge authentication requests. No special privilege level is required; a standard attacker position can leverage these weaknesses. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of the flaws and their sensitivity in authentication systems warrant priority attention.

Remediation

Apply the security update that introduces cryptographically random, single-use OAuth state values; session identifier rotation after successful authentication; constant-time state comparison; enforcement of HTTPS-only redirect URIs; and sanitized, length-limited logging of OAuth error parameters. Verify with your MISP vendor or the project's release notes for the specific version containing these fixes. After patching, review your MISP OAuth configuration to confirm HTTPS is enforced and redirect URIs are correctly specified. Consider rotating credentials and invalidating active AAD-authenticated sessions as a precautionary measure.

Patch guidance

Obtain the patched version of the AAD Authentication Plugin from the MISP project repository or vendor distribution channel. The patch addresses all six identified weaknesses in a single update. Apply the patch to all MISP instances using AAD OAuth integration. Test the patched authentication flow in a non-production environment first to ensure compatibility with your Azure Active Directory tenant configuration. After successful testing, deploy to production and monitor authentication logs for any anomalies. If you are unable to patch immediately, disable AAD authentication on internet-facing MISP instances and use alternative authentication methods (LDAP, local accounts) as a temporary workaround.

Detection guidance

Monitor MISP authentication logs for patterns indicating session hijacking: multiple login events from the same session ID but different source IPs or user agents, or logins immediately after an OAuth error. Review web server access logs for OAuth redirect URIs containing session identifiers or state parameters that appear in referer headers or proxy logs—these are indicators of state leakage. Search audit logs for truncated or corrupted error messages from the OAuth callback endpoint, which may signal log injection attempts. Check network traffic (if you have visibility) for unencrypted OAuth redirect callbacks; any OAuth redirect URIs using HTTP (not HTTPS) are a configuration red flag. Correlate MISP session activity with Azure AD sign-in logs to identify mismatches or replay patterns.

Why prioritize this

This vulnerability combines multiple authentication and session management flaws in a centralized identity integration point. MISP instances often handle sensitive threat intelligence and are frequently targets for reconnaissance and credential theft. The CVSS 8.8 (HIGH) score reflects the high impact (confidentiality, integrity, availability all rated high) and low complexity of exploitation. Although not yet in KEV, the authentication bypass and audit trail corruption implications make this a priority for any organization relying on MISP for intelligence operations. The user interaction requirement (phishing, malicious redirect) is a realistic attack vector in targeted campaigns.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is justified by: (1) Network-accessible attack vector—the OAuth flow is exposed to the internet; (2) Low attack complexity—no special conditions or credentials required beyond user interaction; (3) User interaction required—phishing or social engineering can trigger the flow; (4) High confidentiality impact—session hijacking and CSRF enable unauthorized data access; (5) High integrity impact—forged authentication and log injection enable unauthorized modifications; (6) High availability impact—session fixation and replay attacks can disrupt legitimate access. The severity reflects the foundational nature of authentication flaws and the sensitive data typically protected by MISP.

Frequently asked questions