What’s Vulnerable › Vulnerabilities

CVE-2026-85588: phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-14
• Weakness: CWE-200

Description

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.

Affected products

• thorsten phpMyFAQ: before 4.1.8 — fixed in 4.1.8

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.8. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xhgx-2wj8-g4pj
• https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-totp-secret-exposure-via-data-export

Get alerted when CVE-2026-85588 or the next vulnerability affects your stack