CVE-2026-85588: phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.8 - Operational
For any TOTP seeds exposed via plaintext data export ZIP files in phpMyFAQ versions before 4.1.8, rotate/re-enroll affected users' TOTP (regenerate new TOTP seeds) to invalidate previously generated one-time codes.
Event History
Frequently Asked Questions
Which installations are affected?
phpMyFAQ versions before 4.1.8 are affected. The issue concerns user data export ZIP files produced by those versions.
What does an attacker need to bypass two-factor authentication?
An attacker needs to obtain an exported user-data ZIP archive containing a live TOTP shared secret. The plaintext seed can then be used to generate valid one-time codes.
How can I determine whether sensitive TOTP data was exposed?
Identify user data export ZIP files created by affected phpMyFAQ versions and inspect whether they contain live TOTP shared secrets in plaintext. Any party that obtained such an archive could potentially generate codes for the associated account.