https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:14:06 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1170 certfr-2026-avi-1170 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1170 https://cve.radiocsirt.org/vuln/euvd-2026-363527 EUVD-2026-363527 https://cve.radiocsirt.org/vuln/euvd-2026-363527 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85238 <p>MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.</p> <p>As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim&#39;s authenticated MISP session, potentially gaining the privileges associated with the victim&#39;s account.</p> <p>The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session-&gt;renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.</p> <p>MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.</p> <p>As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim&#39;s authenticated MISP session, potentially gaining the privileges associated with the victim&#39;s account.</p> <p>The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session-&gt;renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-85238 https://cve.radiocsirt.org/vuln/ghsa-q8j2-7wc6-q8m4 <p>MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.</p> <p>As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim&#39;s authenticated MISP session, potentially gaining the privileges associated with the victim&#39;s account.</p> <p>The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session-&gt;renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.</p> <p>MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.</p> <p>As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim&#39;s authenticated MISP session, potentially gaining the privileges associated with the victim&#39;s account.</p> <p>The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session-&gt;renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.</p> https://cve.radiocsirt.org/vuln/ghsa-q8j2-7wc6-q8m4 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3173 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen, Daten oder Sitzungen zu manipulieren und die Verfügbarkeit zu beeinträchtigen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen, Daten oder Sitzungen zu manipulieren und die Verfügbarkeit zu beeinträchtigen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3173