Skip to content
CVE IDCVE-2026-61630GitHub advisory IDGHSA-hf33-q6cf-c66f

nginx ignition has TOTP Reuse During Validity Window

CVE-2026-61630 (GitHub advisory GHSA-hf33-q6cf-c66f) is a medium-severity vulnerability with a CVSS 3.1 base score of 4.2, classed as Improper Authentication (CWE-287), in github.com/lucasdillmann/nginx-ignition (Go). Affected versions: >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6. It is fixed in 0.0.0-20260328015550-8d35e1eb5dd6.

Medium4.2Fix availableGitHub reviewed

Published 21 Sept 2026Updated 21 Sept 2026

4.2MediumCVSS 3.1
CVE ID
CVE-2026-61630
GHSA ID
GHSA-hf33-q6cf-c66f
EPSS
Not scored
Weakness (CWE)
KEV status
Not in KEV
Published
21 Sept 2026
Updated
21 Sept 2026
Ecosystem
  • Go
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window.

Details

The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused.

Section 6.5.1 within the Authentication section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs:

Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once.

The OWASP WSTG also references this as one of their checks to look for:

Can the OTPs be used more than once?

PoC

https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e

Impact

Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.

Similar CVEs

Remediation

Store a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After their validity window has closed, the 2FA code can be removed from the list.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Medium4.2Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
High
Privileges Required PR
High
User Interaction UI
Required
Scope S
Unchanged
Confidentiality C
High
Integrity I
None
Availability A
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • github.com/lucasdillmann/nginx-ignition
    Go
    pkg:golang/github.com/lucasdillmann/nginx-ignition
    Affected versions
    >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6
    Fixed in
    0.0.0-20260328015550-8d35e1eb5dd6

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later.

Patch commits

  • 1cbfae0Patch commitgithub.com/lucasdillmann/nginx-ignition

    2FA (#92)

    +3185 −910 across 30 files

    • .github/workflows/release.yml+1 −1
    • .github/workflows/snapshot.yml+2 −2
    • .golangci.yml+11 −0
    • Makefile+4 −1
    • api/accesslist/artifacts_test.go+9 −19
    • api/cache/artifacts_test.go+10 −11
    • api/certificate/converter.go+2 −4
    • api/common/converter/safe_convert_test.go+1 −2
    • and 22 more files
  • 8d35e1ePatch commitgithub.com/lucasdillmann/nginx-ignition

    Security fixes (#104)

    +782 −350 across 30 files

    • CHANGELOG.md+3 −0
    • api/go.mod+2 −2
    • api/go.sum+4 −4
    • certificate/letsencrypt/go.mod+28 −28
    • certificate/letsencrypt/go.sum+58 −0
    • core/user/model.go+3 −2
    • core/user/repository.go+1 −0
    • core/user/service.go+16 −1
    • and 22 more files
  • #104Pull requestgithub.com/lucasdillmann/nginx-ignition

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 1140609Release commit2.35.1github.com/lucasdillmann/nginx-ignition

Vulnerability intelligence

References

Credits

Questions about CVE-2026-61630

What is the GHSA ID for CVE-2026-61630?
GitHub tracks CVE-2026-61630 as GHSA-hf33-q6cf-c66f.
What is the CVSS score of CVE-2026-61630?
CVE-2026-61630 has a CVSS 3.1 base score of 4.2 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.
Which versions are affected by CVE-2026-61630?
github.com/lucasdillmann/nginx-ignition (Go): >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6.
How do I fix CVE-2026-61630?
Upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later. The fix is in commits 1cbfae0 and 8d35e1e and pull request #104.
What is the Package URL (PURL) for CVE-2026-61630?
The affected package's PURL is pkg:golang/github.com/lucasdillmann/nginx-ignition.
Is CVE-2026-61630 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-61630. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none".

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded
  • FIRST EPSSUnavailable

Fetched 1 day ago (14 Oct 2026, 17:49 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.