Warning: A Two-Factor Authentication (TOTP) Vulnerability in MISP Results to Duplicate Authentication within Valid Period, Patch Immediately!

**Last update:** 02/10/2026 MISP versions prior to 2.5.48 are affected by CVE-2026-103655, a critical TOTP replay vulnerability (CVSS ~9.3–9.4) where one-time codes can be accepted more than once during their validity window, allowing an attacker who captures a code to replay it and authenticate as the targeted user; vendors and CCB recommend urgent patching to 2.5.48+, enhanced monitoring/detection, and incident reporting.