CVE-2026-9084

Medium

Description

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

SeverityMedium

CVSS6.0

Exploit probability—

ProductMisp

PublishedMay 20, 2026

First seenMay 20, 2026

Weakness typeCWE-287Improper authentication

How to fix

Patches

github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172

Affected products

Product	Affected versions	Fixed in
misp misp	2.5.0 ≤ v ≤ 2.5.37	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.