[MEDIUM] Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

PKSA-qv5y-crcz-9nxw GHSA-2jx3-65f3-xr8r

Affected package: spomky-labs/otphp

Affected version: <11.4.3

Reported by:
GitHub, FriendsOfPHP/security-advisories