The fix for GHSA-hhvg-6qmv-58vc does not cover OTP codes for a later time step accepted due to otp_drift. Such a code can be reused once the 30 second check in otp_update_last_use passes.

Impact

Replay of an already used OTP code (CWE-294) with the default otp_drift. Exploiting it requires the password and a used code for a later time step than the server's (from an authenticator whose clock was ahead), replayed starting 30 seconds after its use (for 30 to 60 seconds). Setting otp_drift nil avoids it.