Skip to content
Heist/ feed
UnratedFix available

nginx ignition has TOTP Reuse During Validity Window

Type: advisorySource: OSV1 source record

### Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. ### Details The https://github.com/pquerna/otp package [doesn't include](https://github.com/pquerna/otp/issues/61) checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused. Section 6.5.1 within the [Authentication](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md) section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs: > Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once. The OWASP WSTG also references this as one of their [checks](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/11-Testing_Multi-Factor_Authentication) to look for: > Can the OTPs be used more than once? ### PoC https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e ### Impact Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA. ### Similar CVEs - [CVE-2025-6014](https://nvd.nist.gov/vuln/detail/CVE-2025-6014) - [CVE-2025-55003](https://nv

Announced Source revision 1
Original source ↗

GHSA-hf33-q6cf-c66f

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-hf33-q6cf-c66f

github.com/lucasdillmann/nginx-ignition

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.0.0-20260328015550-8d35e1eb5dd6

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.0.0-20260217145239-1cbfae0296f1"
          },
          {
            "fixed": "0.0.0-20260328015550-8d35e1eb5dd6"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/lucasdillmann/nginx-ignition",
      "purl": "pkg:golang/github.com/lucasdillmann/nginx-ignition",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hf33-q6cf-c66f/GHSA-hf33-q6cf-c66f.json"
    }
  }
]
Related CVEs
CVE-2026-61630

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#23420 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement