CVE-2026-85238

The record

MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account. The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.

Affected packages

Related vulnerabilities

• CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-384
• CVE-2026-64857 tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. CWE-384
• CVE-2026-86674 A vulnerability was found in ningzichun Student Management System up to… CWE-384
• CVE-2026-76196 Photoshop Mobile is affected by a Session Fixation vulnerability that could result in… CWE-384
• CVE-2026-86279 A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management &… CWE-384
• CVE-2026-84652 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the… CWE-384
• CVE-2026-18527 IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i… CWE-384
• CVE-2026-81826 Affected versions of Flowintel do not revoke existing authenticated sessions when a… CWE-384