CVE-2026-44460 FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
An attacker with a victim's password can retrieve their TOTP secret via a setup endpoint, bypassing two-factor authentication to gain full account access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44460?
CVE-2026-44460 is a high-severity authentication bypass vulnerability in error311 FileRise, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0.
Which versions are affected by CVE-2026-44460?
How do I fix CVE-2026-44460?
No fix has been published for CVE-2026-44460 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44460 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44460 exists.
Sources
Also known as GHSA-84hw-8g73-v3f8.