High
CVSS 8.7 Business Logic Responsible Disclosure
Disclosure
Google 2FA TOTP Secret Exposed in Plaintext via Profile API
When a user enables Google Authenticator 2FA, their TOTP secret key is stored on the server. The problem is that this secret is returned in the API response when fetching the user's profile. Anyone with access to the user's token can read this secret, generate valid 2FA codes, and disable 2FA entirely
- Target
- Crypto Gaming Platform
- Category
- Business Logic
- Channel
- Responsible Disclosure
- Disclosed
- 2026-03
Redaction note
Vendor identity withheld.
This finding is documented here as part of MemCyber’s public disclosure record. The vendor has been anonymized to a sector and region descriptor. Full technical detail — including root cause, reproducible proof-of-concept, remediation guidance, and vendor attribution where granted — is available to qualified prospects under NDA.
Coordinated disclosure
How we handled it.
- Reported to the vendor via Responsible Disclosure with a reproducible proof-of-concept.
- Triage + remediation window coordinated with the vendor security team.
- Fix verified before any public reference.
- This record published only after the embargo period closed.