GHSA-hf33-q6cf-c66f: Medium severity go/github.com/lucasdillmann/nginx-ignition vulnerability
Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window.
Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused.
Section 6.5.1 within the Authentication section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs:
Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once.
The OWASP WSTG also references this as one of their checks to look for:
Can the OTPs be used more than once?
PoC
https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e
Impact Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.
Similar CVEs - CVE-2025-6014 - CVE-2025-55003 - CVE-2026-33473
Remediation Store a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After their validity window has closed, the 2FA code can be removed from the list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/lucasdillmann/nginx-ignitionto a version that resolves this vulnerability.Fixed in 0.0.0-20260328015550-8d35e1eb5dd6 - Configuration
Verify that lookup secrets, out-of-band authentication requests or codes, and TOTPs are only successfully usable once. After the validity window closes, remove the 2FA code from the deny-list. If the user’s TOTP is reused during the standard 30 second validity window, reject it by tracking used codes per validity window.
2FA/TOTP verification logic (applications using github.com/pquerna/otp) TOTP code reuse prevention = Enable deny-list of TOTP codes for the validity window and reject any submitted code that already exists in the deny-list
Event History
Frequently Asked Questions
Who is affected by this issue?
Users who have enabled OTP-based two-factor authentication are affected if the application accepts the same TOTP more than once during its standard 30-second validity window.
What does an attacker need to exploit it?
An attacker needs a valid TOTP from a user and must reuse it before the 30-second validity window expires. The provided data does not describe how the attacker obtains that code.
Does the underlying OTP library prevent reuse by default?
No. The pquerna/otp package does not check whether a TOTP has already been used within its validity window; applications using it must implement their own tracking and rejection of previously accepted codes.
What mitigation is available if a fix cannot be deployed immediately?
Implement server-side tracking of accepted TOTPs and reject any code that has already been successfully used during its validity window.