PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10861 misp CVE debrief

CVE-2026-10861 is an open redirect vulnerability in MISP UsersController::routeafterlogin(). An unauthenticated remote attacker could craft a link to redirect a victim to an attacker-controlled external URL after successful authentication, potentially increasing the credibility of phishing attacks or delivering attacker-controlled content. The vulnerability is described as CWE-601, which involves accepting user-controlled input that specifies an external link and using it in a redirect.

Vendor
misp
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of MISP (Malware Information Sharing Platform) instances, particularly those who manage or interact with sensitive information, should be aware of this vulnerability. This includes MISP administrators, users with access to sensitive data, and security teams monitoring for potential phishing attacks or unauthorized redirects.

Technical summary

The open redirect vulnerability exists because the value stored in the pre_login_requested_url session key is used as the post-login redirect destination without sufficient enforcement that it is a local application path. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the patch: Upgrade to MISP version 2.5.39 or later, which includes the fix for this vulnerability. The patch can be found at resourceLinkAnnotations with linkId 'ref-4'.
  • Restrict URL redirects: Implement additional checks to ensure that redirect URLs are validated and only allow local application paths.
  • Monitor for suspicious activity: Keep an eye on MISP instance logs for any suspicious redirect attempts or unauthorized access.

Evidence notes

The CVE-2026-10861 vulnerability was published on 2026-06-04 and modified on 2026-06-08. The CVSS score is 5.1, indicating a medium severity. The vulnerability is categorized under CWE-601.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10861 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10861

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10861 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10861

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/ae760b7bf534f2798810d59a1f961b31adb3443e

    5a6e4751-2f3f-4070-9419-94fb35b644e8 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.