CVE-2026-85588
Received Received - Intake

phpMyFAQ Plaintext TOTP Secrets in User Export Files

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85588
EUVD
EUVD-2026-71011

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.8 (exc)
phpmyfaq phpmyfaq 4.1.7
phpmyfaq phpmyfaq 4.2.0-alpha.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85588 is a vulnerability in phpMyFAQ versions before 4.1.8 where TOTP shared secrets are stored in plaintext within user data export ZIP files. Attackers who gain access to these exported files can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.

Detection Guidance

Check exported user data ZIP files for plaintext TOTP secrets in the JSON data. Look for fields containing 'totpSecret' or similar in the export. Review file contents with commands like 'unzip -l export.zip' and 'unzip -p export.zip | grep -i totpsecret'.

Impact Analysis

If you use phpMyFAQ versions before 4.1.8, an attacker who obtains your exported user data can bypass your two-factor authentication by generating valid one-time codes. This could allow unauthorized access to your account even with 2FA enabled.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing TOTP secrets in plaintext during data exports. GDPR requires protection of personal data, and HIPAA mandates safeguarding sensitive health information. Unauthorized access to TOTP seeds could lead to unauthorized account access, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.8 or later immediately. Remove any existing exported user data files containing TOTP secrets. Disable user data exports until the upgrade is confirmed. Review and rotate any exposed TOTP secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85588. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart