Listen to this Post
The pquerna/otp library for Go implements TOTP (Time-based One-Time Password) generation and validation according to RFC 6238. TOTP codes are typically valid for a 30-second window, during which the server should accept the code only once. However, the library’s `totp.Validate` function does not track whether a code has already been used within its validity window. This means that if an attacker can capture a TOTP code (e.g., via network sniffing, phishing, or social engineering), they can replay the same code multiple times within the 30-second window to authenticate additional sessions. The vulnerability arises because the library only checks the code’s mathematical validity against the shared secret and current time, without maintaining a deny-list of used codes. Applications that rely solely on the library’s validation function are therefore susceptible to TOTP reuse attacks. This violates OWASP ASVS requirement 6.5.1, which states that TOTPs must be usable only once. The issue affects any Go application that uses the pquerna/otp library for 2FA without implementing additional reuse prevention. The CVE-2026-33473 was assigned to this vulnerability, and it has a medium severity rating. The root cause is the lack of stateful tracking of used TOTP codes within the library. To mitigate, developers must implement their own deny-list mechanism. The vulnerability was discovered in the Vikunja project, which uses pquerna/otp, but the underlying library issue affects all users. The PoC demonstrates that a captured TOTP can be reused within the window. The impact is a disruption of the defense-in-depth model for 2FA. The remediation involves storing used codes and checking against them. The library itself has not been patched; applications must implement the fix. The CVE was published on 2026-03-20. The expected patch date for applications is 2026-03-20, as Vikunja released version 2.2.1 to address the issue. Users of pquerna/otp should upgrade their applications and implement reuse prevention. The vulnerability highlights the importance of stateful checks in authentication mechanisms. This is a classic example of a time-of-check to time-of-use issue. The 30-second window provides a limited but exploitable opportunity. Attackers can automate the replay process. The lack of a deny-list is a common oversight in TOTP implementations. Developers must ensure that each TOTP is invalidated after first use. The OWASP WSTG also recommends testing for OTP reuse. This CVE serves as a reminder to audit 2FA implementations. The pquerna/otp library is widely used, making the impact broad. The fix requires application-level changes. The library maintainers may consider adding optional reuse tracking in future versions. Until then, developers must be vigilant.
DailyCVE Form:
Platform: Go
Version: 1.4.0
Vulnerability: TOTP reuse
Severity: Medium
date: 2026-03-20
Prediction: 2026-03-20
What Undercode Say:
go get github.com/pquerna/otp go test -run TestTOTPReuse
package main
import (
"fmt"
"github.com/pquerna/otp/totp"
"time"
)
func main() {
secret := "JBSWY3DPEHPK3PXP"
code, _ := totp.GenerateCode(secret, time.Now())
fmt.Println("Generated TOTP:", code)
valid := totp.Validate(code, secret)
fmt.Println("Validation result:", valid)
// Reuse the same code within the window
validAgain := totp.Validate(code, secret)
fmt.Println("Second validation result:", validAgain) // Should be true, but should be false
}
Exploit: (Educational Purposes!)
Capture a valid TOTP code via network sniffing, phishing, or social engineering. Within the 30-second validity window, replay the code to authenticate multiple sessions.
First authentication curl -X POST https://target.com/login -d "username=user&password=pass&totp=123456" Replay the same TOTP within 30 seconds curl -X POST https://target.com/login -d "username=user&password=pass&totp=123456"
Protection: from this CVE
Implement a deny-list of used TOTP codes for their validity windows and check submitted codes against it to ensure none are being reused. After the validity window has closed, remove the code from the list.
var usedCodes = make(map[bash]time.Time)
func validateTOTP(code, secret string) bool {
if _, used := usedCodes[bash]; used {
return false
}
if totp.Validate(code, secret) {
usedCodes[bash] = time.Now().Add(30 time.Second)
return true
}
return false
}
Impact:
Any user who uses 2FA could be impacted if their traffic is able to be captured, they’re phished/social engineered, or other methods of attack. This disrupts one layer of the defense-in-depth model surrounding 2FA.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
