Executive brief
phpMyFAQ is a frequently-asked-questions knowledge base system used by organizations to publish self-service documentation. A flaw in its GDPR data export feature exposes active two-factor authentication (2FA) seeds in plaintext ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, completely bypassing the account's second-factor authentication and gaining unauthorized access.
Technical details
The vulnerability is a sensitive information disclosure (CWE-200) in the user data export API endpoint (POST /api/user/data/export). The exportUserData() function includes the TOTP shared secret from the faquserdata table directly in the export JSON without redaction or field allowlisting. An authenticated user can trigger the export to download a ZIP containing userdata.json with plaintext "secret" and "twofactor_enabled" fields. An attacker who obtains this archive—through browser caches, email, cloud backups, or file transfer—can use the seed to generate valid one-time codes. The fix (version 4.1.8+) removes the secret field from the export and implements an explicit allowlist of safe, non-credential fields. Attack requires a valid user account and network access to the API endpoint.
Affected products
- thorsten phpMyFAQ <4.1.8
Timeline
- 2026-08-20: disclosed: Security advisory GHSA-xhgx-2wj8-g4pj published by maintainer
- 2026-09-04: advisory: CVE-2026-85588 published on NVD
- 2026-08-20: patched: Fixed in version 4.1.8