CVE-2026-85588 — phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed a…
Published: 2026-09-04 · CVSS: 5.3 · CVSS 4.0
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7