{"id":"CVE-2026-85588","title":"phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files","summary":"phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authen…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-200"],"vendor":"thorsten","product":"phpMyFAQ","affected":["phpMyFAQ < 4.1.8"],"published":"2026-09-04","updated":"2026-09-14","sourceUpdated":"2026-09-14T14:17:14.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85588","references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xhgx-2wj8-g4pj","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-totp-secret-exposure-via-data-export","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T13:24:41.527941Z"},"cvssSource":"cna","epss":0.00375,"epssPercentile":0.31288,"ingestedAt":"2026-09-08T20:10:03.164Z","slug":"CVE-2026-85588","body":"## Overview\n\nphpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202041,"id":"CVE-2026-85588","ts":1789400046692,"field":"cvss","old":null,"new":"5.3"},{"seq":202040,"id":"CVE-2026-85588","ts":1789400046692,"field":"severity","old":"none","new":"medium"},{"seq":200768,"id":"CVE-2026-85588","ts":1789397615248,"field":"cvss","old":"5.3","new":null},{"seq":200767,"id":"CVE-2026-85588","ts":1789397615248,"field":"severity","old":"medium","new":"none"},{"seq":200083,"id":"CVE-2026-85588","ts":1789395646379,"field":"cvss","old":null,"new":"5.3"},{"seq":200082,"id":"CVE-2026-85588","ts":1789395646379,"field":"severity","old":"none","new":"medium"}]}