EUVD-2026-90542

MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...