Executive brief
nginx ignition is an authentication system that supports two-factor authentication via time-based one-time passwords (TOTP). A design flaw allows an attacker to reuse a valid TOTP code multiple times within its standard 30-second validity window, potentially bypassing two-factor authentication if they obtain a code through phishing, traffic interception, or social engineering.
Technical details
The vulnerability stems from incomplete implementation of TOTP validation logic. The underlying pquerna/otp Go package does not enforce single-use semantics for TOTP codes, requiring applications to separately track and deny reused codes within the validity window. nginx ignition fails to implement this check, allowing an attacker who captures or obtains a valid TOTP to submit it repeatedly during the 30-second window without rejection. The attack requires knowledge of a valid code but no authentication credentials. Remediation involves maintaining a deny-list of recently-used TOTP codes scoped to each user and checking new submissions against this list; codes can be purged after their validity window expires.
Affected products
- nginx nginx ignition
Timeline
- 2026-09-21: disclosed
- 2026: other: CVE-2026-61630 assigned