CVE-2026-95754

CVE-2026-95754 affects MISP 's UsersController::login() method. The pre-authentication database query for the TOTP verification branch omitted the User.disabled column from its SELECT fields, so the disabled-user guard evaluated to null (falsy), allowing a disabled, TOTP-enrolled user to reach th...