OpenBao TOTP Secrets Engine Enables Code Reuse

OpenBao's TOTP secrets engine accepts the same authentication code multiple times instead of just once, allowing someone who obtains a valid code to reuse it for unauthorized access. This weakens the security of time-based one-time passwords, which are meant to be single-use.

The TOTP secrets engine in OpenBao 0.1.0-2.3.1 fails to enforce strict single-use validation of time-based one-time passwords due to unexpected normalization behavior in the underlying TOTP library, enabling code reuse attacks. An attacker with access to a valid TOTP code can replay it multiple times against the privileged verification endpoint. Mitigation requires normalizing all codes before submission to the OpenBao endpoint.