---
id: CVE-2026-85238
title: >-
  MISP contains a session fixation vulnerability in the CustomAuth
  authentication (a custom configuration) flow
summary: >-
  MISP contains a session fixation vulnerability in the CustomAuth
  authentication (a custom configuration) flow. When a user was successfully
  authenticated through CustomAuth, MISP stored the authenticated user identity
  in the existing ses…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-384
vendor: misp-project
product: misp
affected:
  - misp <= 2.5.45
published: '2026-09-03'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T14:17:04.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85238'
references:
  - url: 'https://github.com/MISP/MISP/commit/e2eb2f058'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
epss: 0.00335
epssPercentile: 0.24162
ingestedAt: '2026-09-11T16:45:47.844Z'
---

## Overview

MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier.


As a result, if an attacker can cause a victim to use a session identifier known to the attacker before authentication, that same session identifier remains valid after the victim successfully authenticates. The attacker could subsequently reuse the fixed session identifier to access the victim's authenticated MISP session, potentially gaining the privileges associated with the victim's account.


The issue occurs because __customAuthentication() wrote the authenticated user into the existing CakePHP session while the call to Session->renew() had previously been disabled. The patch restores session identifier rotation when a new authentication occurs or when the authenticated user changes, while avoiding unnecessary session renewal on every request.

## Affected

- `misp <= 2.5.45`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.