# CVE-2026-61630: nginx ignition has TOTP Reuse During Validity Window

> CVE-2026-61630 (GitHub advisory GHSA-hf33-q6cf-c66f) is a medium-severity vulnerability with a CVSS 3.1 base score of 4.2, classed as Improper Authentication (CWE-287), in github.com/lucasdillmann/nginx-ignition (Go). Affected versions: >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6. It is fixed in 0.0.0-20260328015550-8d35e1eb5dd6.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-61630

| Field | Value |
| --- | --- |
| CVE | CVE-2026-61630 |
| GHSA | GHSA-hf33-q6cf-c66f |
| Severity | Medium |
| CVSS 3.1 | 4.2 `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N` (GitHub Advisory Database) |
| CWE | CWE-287 Improper Authentication |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 21 Sept 2026 |
| Modified | 21 Sept 2026 |

## Description

Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window.

##### Details
The https://github.com/pquerna/otp package [doesn't include](https://github.com/pquerna/otp/issues/61) checking for already used TOTPs within its the validity window. This requires each application that uses the package to implement their own method of tracking and verifying that codes can't be reused.

Section 6.5.1 within the [Authentication](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md) section of the OWASP ASVS recommends multiple checks, some of which involving TOTPs:

> Verify that lookup secrets, out-of-band authentication requests or codes, and time-based one-time passwords (TOTPs) are only successfully usable once.

The OWASP WSTG also references this as one of their [checks](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/11-Testing_Multi-Factor_Authentication) to look for:

> Can the OTPs be used more than once?

##### PoC

https://github.com/user-attachments/assets/86a43374-39bf-4d61-8f6d-5cc440c99a1e

##### Impact
Any user who uses 2FA could be impacted if their traffic is able to be captured, they're phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.

##### Similar CVEs
- [CVE-2025-6014](https://nvd.nist.gov/vuln/detail/CVE-2025-6014)
- [CVE-2025-55003](https://nvd.nist.gov/vuln/detail/CVE-2025-55003)
- [CVE-2026-33473](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p747-qc5p-773r)

##### Remediation
Store a deny-list of TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After their validity window has closed, the 2FA code can be removed from the list.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| github.com/lucasdillmann/nginx-ignition | Go | `pkg:golang/github.com/lucasdillmann/nginx-ignition` | >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6 | 0.0.0-20260328015550-8d35e1eb5dd6 |

## Fix commits

- Patch: https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e
- Patch: https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107
- Pull request: https://github.com/lucasdillmann/nginx-ignition/pull/104
- Release: https://github.com/lucasdillmann/nginx-ignition/commit/114060945bbeb8a71db79bc88f24da9b6e5efc18 (2.35.1)

## Questions

**What is the GHSA ID for CVE-2026-61630?**

GitHub tracks CVE-2026-61630 as GHSA-hf33-q6cf-c66f.

**What is the CVSS score of CVE-2026-61630?**

CVE-2026-61630 has a CVSS 3.1 base score of 4.2 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.

**Which versions are affected by CVE-2026-61630?**

github.com/lucasdillmann/nginx-ignition (Go): >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6.

**How do I fix CVE-2026-61630?**

Upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 or later. The fix is in commits 1cbfae0 and 8d35e1e and pull request #104.

**What is the Package URL (PURL) for CVE-2026-61630?**

The affected package's PURL is pkg:golang/github.com/lucasdillmann/nginx-ignition.

**Is CVE-2026-61630 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-61630. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none".

## References

- https://github.com/lucasdillmann/nginx-ignition/pull/104 (fix)
- https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e (fix)
- https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107 (fix)
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-61630 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61630.json (advisory)
- https://github.com/advisories/GHSA-hf33-q6cf-c66f (advisory)
- https://github.com/pquerna/otp/issues/61 (report)
- https://github.com/lucasdillmann/nginx-ignition (package)
- https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.35.1

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-61630), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.