vulnerability / NVI-00004186 / Revision 1

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

OSV carries this publisher advisory for spomky-labs/otphp. This is an aggregated source copy; consult the original publisher and compare update dates.

source listedactiveGHSA-g7m4-839x-ch6v

This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.

01 / Meaning

Why it matters

Published affected context helps an owner decide what evidence to gather. This report has not examined your application.

02 / Applicability

The affected context

Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.

spomky-labs/otphp

source listed

ECOSYSTEM: introduced 0; fixed 11.4.3

## Summary The `digits` parameter parsed from a provisioning URI is validated only with a lower bound (`$value > 0`) and has no upper bound (`src/OTP.php:353-357`). OTP generation computes `$code % (10 ** $this->getDigits())` (`src/OTP.php:283`). When `digits` is large enough that `10 ** digits` overflows PHP's integer range and the `(int)` cast yields `0` (around `digits >= 40` on 64-bit PHP 8.x), the modulo operand becomes `0` and PHP raises a `DivisionByZeroError`. ## Impact `OTPHP\Factory::loadFromProvisioningUri()` forwards the attacker-controlled `digits` query value to `setParameter('digits', $value)`, so a hostile URI such as `otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&digits=50` produces an OTP object whose `at()`, `now()`, and `verify()` all throw `DivisionByZeroError`. Because `DivisionByZeroError` extends `Error` (not `Exception`), callers that guard OTP generation with a `catch (\Exception)` do not catch it, turning a malformed URI into an unhandled fatal error (denial of service of the verification path). Measured threshold on PHP 8.3: `digits = 30` works, `digits >= 40` throws `DivisionByZeroError: Modulo by zero`. ## Affected component - `src/OTP.php:353-357

GitHub Advisory Database via OSV

03 / Response

What to do next

vendor patch
The original advisory lists fixed boundaries 11.4.3 for spomky-labs/otphp. Confirm the publisher’s latest guidance.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

A fixed release is not deployment evidence.

Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.

04 / Limits

What this report cannot establish

Customer inventory, deployment, reachability and exploitation have not been inspected.

Read the collection and interpretation limits ↗

05 / Provenance

Sources you can inspect

Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.

GHSA-g7m4-839x-ch6v ↗
GitHub Advisory Database via OSV · vendor advisory
Observed Oct 31, 2026. GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.

Public revision history

Only published revisions appear here. Routine fetches do not create a material-change event.

Revision 1 · Oct 31, 2026
First indexed by Null; source disclosure date is shown separately.

Read the public revision data ↗