Executive brief
A vulnerability in the otphp library, which handles One-Time Password (OTP) generation, allows malicious provisioning URIs (like those in QR codes) to corrupt the internal state of the application. This can lead to service outages where users cannot verify their login codes or cause the application to crash unexpectedly. It may also allow an attacker to bypass certain validation checks for labels and issuers.
Technical details
The vulnerability is a mass-assignment (CWE-915) issue located in `OTPHP\Factory::loadFromProvisioningUri()`. The function parses `otpauth://` URIs and forwards all query parameters to `OTP::setParameter()`, which uses `property_exists()` and dynamic property writes to update internal object attributes. An attacker can craft a URI with specific query keys to overwrite internal properties such as `$parameters`, `issuer`, or the `clock`. This can result in state corruption (making the OTP object unusable), uncaught `TypeError` exceptions that bypass documented error handling, and validation bypasses for labels and issuers. The issue is fixed in version 11.4.3 by implementing an allow-list for URI parameters.
Affected products
- spomky-labs otphp < 11.4.3
Timeline
- 2026-05-31: disclosed: Initial disclosure by Spomky
- 2026-06-18: advisory: GitHub Advisory published
- 2026-06-18: patched: Fix released in version 11.4.3