CVE-2026-92002

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

CVE-2026-92003

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-92003

MISP (versions ≤2.5.45) contains an unthrottled authentication-failure logging flaw. Two API authentication-failure branches—requests with no authentication key and requests with an API key of incorrect length —wrote directly to the Log model, bypassing the _shouldLog() throttle used by other fai...

CVE-2026-92002

MISP versions ≤2.5.45 use Redis to throttle repeated authentication-failure log entries. The root cause lies in the _shouldLog() method: when User->setupRedis() returns false (i.e., Redis is unreachable), the throttle check suppresses all log writes, effectively silencing authentication-failur...