Executive brief
A vulnerability in the otphp library, which is used to generate one-time passwords (OTP) for two-factor authentication, can allow an attacker to crash an application. By providing a specially crafted login link with an extremely large number of digits requested, an attacker can trigger a fatal error that bypasses standard error handling. This results in a denial-of-service, preventing legitimate users from completing the login or verification process.
Technical details
The otphp library fails to enforce an upper bound on the 'digits' parameter when parsing provisioning URIs via `OTPHP\Factory::loadFromProvisioningUri()`. During OTP generation in `src/OTP.php`, the code calculates a modulo using `10 ** $digits`. On 64-bit PHP 8.x systems, if the 'digits' value is large enough (typically >= 40), the exponentiation overflows the integer range and casts to 0, leading to a `DivisionByZeroError`. Because this is a PHP 'Error' rather than an 'Exception', it often escapes standard `catch (\Exception)` blocks, resulting in an unhandled fatal error and denial-of-service. The issue is fixed in version 11.4.3 by enforcing a sane upper bound on the digits parameter.
Affected products
- Spomky-Labs otphp < 11.4.3
Timeline
- 2026-05-31: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched: Fixed in version 11.4.3