CVE-2026-9084

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

CVSS

No CVSS.

References

Link	Resource
https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172

Configurations

No configuration.

History

23 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) El plugin de autenticación OIDC de MISP permitía el enlace automático de una identidad OIDC a una cuenta de usuario local existente basándose en la reclamación de correo electrónico cuando la cuenta local no tenía un valor 'sub' almacenado. Bajo configuraciones de IdP inseguras o no confiables donde la propiedad del correo electrónico no se exige, un atacante con un token OIDC válido podría afirmar la dirección de correo electrónico de una víctima y autenticarse como ese usuario, lo que llevaría a una toma de control de la cuenta.

20 May 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-20 16:16

Updated : 2026-07-23 12:10

NVD link : CVE-2026-9084

Mitre link : CVE-2026-9084

CVE.ORG link : CVE-2026-9084

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-9084", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9084", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T15:28:48.726589Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"vendor": "misp", "product": "misp", "versions": [{"status": "affected", "version": "2.5.0", "versionType": "semver", "lessThanOrEqual": "2.5.37"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T16:16:28.107", "references": [{"url": "https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "MISP\u2019s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim\u2019s email address and authenticate as that user, leading to account takeover."}, {"lang": "es", "value": "El plugin de autenticaci\u00f3n OIDC de MISP permit\u00eda el enlace autom\u00e1tico de una identidad OIDC a una cuenta de usuario local existente bas\u00e1ndose en la reclamaci\u00f3n de correo electr\u00f3nico cuando la cuenta local no ten\u00eda un valor 'sub' almacenado. Bajo configuraciones de IdP inseguras o no confiables donde la propiedad del correo electr\u00f3nico no se exige, un atacante con un token OIDC v\u00e1lido podr\u00eda afirmar la direcci\u00f3n de correo electr\u00f3nico de una v\u00edctima y autenticarse como ese usuario, lo que llevar\u00eda a una toma de control de la cuenta."}], "lastModified": "2026-07-23T12:10:00.110", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}