{"id":"GHSA-g7m4-839x-ch6v","title":"spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation","summary":"spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation","severity":"high","cwe":["CWE-369","CWE-1284"],"vendor":"spomky-labs","product":"spomky-labs/otphp","affected":["spomky-labs/otphp < 11.4.3"],"patched":["spomky-labs/otphp 11.4.3"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-g7m4-839x-ch6v","references":[{"url":"https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-g7m4-839x-ch6v"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/spomky-labs/otphp/GHSA-g7m4-839x-ch6v.yaml"},{"url":"https://github.com/advisories/GHSA-g7m4-839x-ch6v"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-19T03:39:00.767Z","ecosystem":"composer","slug":"GHSA-g7m4-839x-ch6v","body":"## Overview\n\n## Summary\n\nThe `digits` parameter parsed from a provisioning URI is validated only with a lower bound (`$value > 0`) and has no upper bound (`src/OTP.php:353-357`). OTP generation computes `$code % (10 ** $this->getDigits())` (`src/OTP.php:283`). When `digits` is large enough that `10 ** digits` overflows PHP's integer range and the `(int)` cast yields `0` (around `digits >= 40` on 64-bit PHP 8.x), the modulo operand becomes `0` and PHP raises a `DivisionByZeroError`.\n\n## Impact\n\n`OTPHP\\Factory::loadFromProvisioningUri()` forwards the attacker-controlled `digits` query value to `setParameter('digits', $value)`, so a hostile URI such as `otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&digits=50` produces an OTP object whose `at()`, `now()`, and `verify()` all throw `DivisionByZeroError`. Because `DivisionByZeroError` extends `Error` (not `Exception`), callers that guard OTP generation with a `catch (\\Exception)` do not catch it, turning a malformed URI into an unhandled fatal error (denial of service of the verification path).\n\nMeasured threshold on PHP 8.3: `digits = 30` works, `digits >= 40` throws `DivisionByZeroError: Modulo by zero`.\n\n## Affected component\n\n- `src/OTP.php:353-357` — `digits` parameter callback (no upper bound)\n- `src/OTP.php:283` — `$code % (10 ** $this->getDigits())`\n\n## Proof of concept\n\n```php\nuse OTPHP\\Factory;\nuse OTPHP\\InternalClock;\n\n$otp = Factory::loadFromProvisioningUri(\n    'otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&digits=50',\n    new InternalClock()\n);\n$otp->at(0); // DivisionByZeroError: Modulo by zero (escapes catch (\\Exception))\n```\n\n## Remediation\n\nEnforce a sane upper bound on `digits` in the parameter validation callback (e.g. reject values above 8–10, the practical range for OTPs) so that an out-of-range value is rejected with a documented exception instead of producing an object that fails later with an uncatchable `Error`.\n\n## Affected packages\n\n- `spomky-labs/otphp < 11.4.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `spomky-labs/otphp 11.4.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}