Vulnerability-Lookup

GHSA-HF33-Q6CF-C66F

Vulnerability from github – Published: 2026-09-21 21:47 – Updated: 2026-09-21 21:47

Summary

nginx ignition has TOTP Reuse During Validity Window

Details

Summary

Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window.

Details

The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused.

Section 6.5.1 within the Authentication section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs:

Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once.

The OWASP WSTG also references this as one of their checks to look for:

Can the OTPs be used more than once?

PoC

https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e

Impact

Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.

Similar CVEs

Remediation

Store a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After their validity window has closed, the 2FA code can be removed from the list.

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lucasdillmann/nginx-ignition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-20260217145239-1cbfae0296f1"
            },
            {
              "fixed": "0.0.0-20260328015550-8d35e1eb5dd6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61630"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-21T21:47:40Z",
    "nvd_published_at": "2026-09-21T15:17:30Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAny user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window.\n\n### Details\nThe https://github.com/pquerna/otp package [doesn\u0027t include](https://github.com/pquerna/otp/issues/61) checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can\u0027t be reused.\n\nSection 6.5.1 within the [Authentication](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md) section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs:\n\n\u003e Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once.\n\nThe OWASP WSTG also references this as one of their [checks](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/11-Testing_Multi-Factor_Authentication) to look for:\n\n\u003e Can the OTPs be used more than once?\n\n### PoC\n\nhttps://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e\n\n### Impact\nAny user who uses 2FA could be impacted if their traffic is able to be captured, they\u0027re phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.\n\n### Similar CVEs\n- [CVE-2025-6014](https://nvd.nist.gov/vuln/detail/CVE-2025-6014)\n- [CVE-2025-55003](https://nvd.nist.gov/vuln/detail/CVE-2025-55003)\n- [CVE-2026-33473](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p747-qc5p-773r)\n\n### Remediation\nStore a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After their validity window has closed, the 2FA code can be removed from the list.",
  "id": "GHSA-hf33-q6cf-c66f",
  "modified": "2026-09-21T21:47:40Z",
  "published": "2026-09-21T21:47:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61630"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pquerna/otp/issues/61"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lucasdillmann/nginx-ignition/pull/104"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lucasdillmann/nginx-ignition"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.35.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nginx ignition has TOTP Reuse During Validity Window"
}

CVE-2026-61630 (GCVE-0-2026-61630)

Vulnerability from cvelistv5 – Published: 2026-09-21 14:17 – Updated: 2026-09-21 20:46

Title

nginx ignition has TOTP Reuse During Validity Window

Summary

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:40 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/lucasdillmann/nginx-ignition/s…	x_refsource_CONFIRM
https://github.com/lucasdillmann/nginx-ignition/c…	x_refsource_MISC
https://github.com/lucasdillmann/nginx-ignition/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
lucasdillmann	nginx-ignition	Affected: >= 2.33.0, < 2.35.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61630",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:40:23.551843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T20:46:12.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nginx-ignition",
          "vendor": "lucasdillmann",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.33.0, \u003c 2.35.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T14:17:11.371Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f"
        },
        {
          "name": "https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e"
        },
        {
          "name": "https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107"
        }
      ],
      "source": {
        "advisory": "GHSA-hf33-q6cf-c66f",
        "discovery": "UNKNOWN"
      },
      "title": "nginx ignition has TOTP Reuse During Validity Window"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61630",
    "datePublished": "2026-09-21T14:17:11.371Z",
    "dateReserved": "2026-07-10T17:38:57.110Z",
    "dateUpdated": "2026-09-21T20:46:12.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-HF33-Q6CF-C66F

Summary

Details

PoC

Impact

Similar CVEs

Remediation

CVE-2026-61630 (GCVE-0-2026-61630)

Tags

Sightings

Nomenclature

Related by attack behaviour