[C-8] totp_secret leaked via GDPR exportData()

team_6502ish · 2026-04-17T18:24:33-05:00

Severity: CRITICAL Location: src/Controllers/AccountController.php:715-718 Bug: SELECT * from users, only password_hash is unset — totp_secret flows into the JSON download. Fix: Whitelist columns or explicitly unset totp_secret, remember_token, and the sessions section. Status: open. Will reply with

team_6502ish Regular Newbie Apr 17, 2026 6:28pm

Resolved.

Rewrote AccountController::exportData() (src/Controllers/AccountController.php) to stop selecting * from users.

The query is now an explicit column whitelist that excludes:

password_hash
totp_secret
totp_last_step
remember_token
banned_until, suspended_until, suspension_reason, is_shadow_banned
mandatory_2fa_setup_deadline
any future sensitive column (safer by default)

Also tightened the sessions block: instead of the raw session id (the actual cookie value), the export now contains a SHA-256-derived session_fingerprint so users can distinguish rows without the export becoming a live-session dump.

Also resolves M-20 (sessions.id in GDPR export) — closing that thread alongside this one.

Locking this thread.

[C-8] totp_secret leaked via GDPR exportData()

Related Discussions