CVE-2026-85588

UNKNOWN 0.0

phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.

CWE	CWE-200
Vendor	thorsten
Product	phpmyfaq
Published	Sep 4, 2026

Stay Ahead of the Next One

Get instant alerts for thorsten phpmyfaq

Be the first to know when new unknown vulnerabilities affecting thorsten phpmyfaq are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

thorsten / phpMyFAQ

0 < 4.1.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xhgx-2wj8-g4pj vulncheck.com: https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-totp-secret-exposure-via-data-export

Credits

🔍 skeletonsec