Vulnerability Description
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-92003?
CVE-2026-92003 is a documented vulnerability. Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests wi...
How severe is CVE-2026-92003?
CVSS scoring is not yet available for CVE-2026-92003. Check NVD for updates.
Is there a patch for CVE-2026-92003?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.