Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
OTPHP\Factory::loadFromProvisioningUri() parses an attacker-supplied otpauth:// URI and forwards every query key to OTP::setParameter($key, $value). setParameter() resolves the name with propertyexists($this, $parameter) and performs a dynamic write $this-{$parameter} = $value (src/OTP.php:196-197). Because the query keys are entirely controlled by whoever produced the URI, a URI can target the internal properties of the OTP object that are not meant to be set from a URI: parameters, issuer, label, issuerincludedasparameter, and (on TOTP) the readonly clock. This is an instance of object property mass-assignment (CWE-915). Impact The Factory is documented as the entry point for third-party provisioning URIs (e.g. QR codes from Microsoft 365 / Google Authenticator). An application that loads such a URI is exposed to: - State corruption. A URI such as otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP¶meters[foo]=bar overwrites the whole internal $parameters array that…
Recommended action: Upgrade to 11.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The digits parameter parsed from a provisioning URI is validated only with a lower bound ($value 0) and has no upper bound (src/OTP.php:353-357). OTP generation computes $code % (10 $this-getDigits()) (src/OTP.php:283). When digits is large enough that 10 digits overflows PHP's integer range and the (int) cast yields 0 (around digits = 40 on 64-bit PHP 8.x), the modulo operand becomes 0 and PHP raises a DivisionByZeroError. Impact OTPHP\Factory::loadFromProvisioningUri() forwards the attacker-controlled digits query value to setParameter('digits', $value), so a hostile URI such as otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&digits=50 produces an OTP object whose at(), now(), and verify() all throw DivisionByZeroError. Because DivisionByZeroError extends Error (not Exception), callers that guard OTP generation with a catch (\Exception) do not catch it, turning a malformed URI into an unhandled fatal error (denial of service of the verification path). Measured threshold on PHP…
Recommended action: Upgrade to 11.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.