nginx ignition has TOTP Reuse During Validity Window
### Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. ### Details The https://github.com/pquerna/otp package [doesn't include](https://github.com/pquerna/otp/issues/61) checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused. Section 6.5.1 within the [Authentication](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md) section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs: > Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once. The OWASP WSTG also references this as one of their [checks](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/11-Testing_Multi-Factor_Authentication) to look for: > Can the OTPs be used more than once? ### PoC https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e ### Impact Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA. ### Similar CVEs - [CVE-2025-6014](https://nvd.nist.gov/vuln/detail/CVE-2025-6014) - [CVE-2025-55003](https://nv
GO-2026-6537
Revision 1
nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition
nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6537
github.com/lucasdillmann/nginx-ignition
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.0.0-20260328015550-8d35e1eb5dd6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.0.0-20260217145239-1cbfae0296f1"
},
{
"fixed": "0.0.0-20260328015550-8d35e1eb5dd6"
}
]
}
],
"package": {
"name": "github.com/lucasdillmann/nginx-ignition",
"purl": "pkg:golang/github.com/lucasdillmann/nginx-ignition",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6537.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-61630
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23378 · Revision 1
- Added to Heist Feed
- Publisher date
GHSA-hf33-q6cf-c66f
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-hf33-q6cf-c66f
github.com/lucasdillmann/nginx-ignition
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.0.0-20260328015550-8d35e1eb5dd6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.0.0-20260217145239-1cbfae0296f1"
},
{
"fixed": "0.0.0-20260328015550-8d35e1eb5dd6"
}
]
}
],
"package": {
"name": "github.com/lucasdillmann/nginx-ignition",
"purl": "pkg:golang/github.com/lucasdillmann/nginx-ignition",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hf33-q6cf-c66f/GHSA-hf33-q6cf-c66f.json"
}
}
]- Related CVEs
- CVE-2026-61630
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23420 · Revision 1
- Added to Heist Feed
- Publisher date