CVE-2026-61630: nginx ignition has TOTP Reuse During Validity Window
Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window.
Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused.
Section 6.5.1 within the Authentication section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs:
Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once.
The OWASP WSTG also references this as one of their checks to look for:
Can the OTPs be used more than once?
PoC
https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e
Impact Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.
Similar CVEs - CVE-2025-6014 - CVE-2025-55003 - CVE-2026-33473
Remediation Store a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After their validity window has closed, the 2FA code can be removed from the list.
Other sources
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/lucasdillmann/nginx-ignitionto a version that resolves this vulnerability.Fixed in 0.0.0-20260328015550-8d35e1eb5dd6 - Upgrade
Upgrade
nginx ignitionto a version that resolves this vulnerability.Fixed in 2.35.1Patch CVE-2026-33473 - Configuration
In addition to upgrading, store a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused (remove codes after their validity window has closed).
nginx ignition TOTP reuse prevention (deny-list) = Implement deny-list of TOTP codes for their validity windows and reject reused codes within the window
Event History
Frequently Asked Questions
Which deployments are affected?
nginx ignition versions 2.33.0 through 2.35.0 are affected for users who have enabled OTP-based two-factor authentication. Version 2.35.1 patches the issue.
What would an attacker need to exploit this?
The attacker would need a valid TOTP value for an affected user and would need to reuse it within the standard 30-second TOTP validity window. The supplied CVSS vector also indicates high privileges, user interaction, and high attack complexity are required.
How can I determine whether I am exposed?
Check the deployed nginx ignition version and whether users have OTP 2FA enabled. Instances running versions 2.33.0 through 2.35.0 with OTP-enabled users should be treated as affected.
What is the remediation?
Upgrade nginx ignition to version 2.35.1, which patches TOTP reuse during the validity window.