CVE-2026-61630mediumCWE-287

CVE-2026-61630: medium-severity vulnerability in lucasdillmann nginx-ignition

nginx ignition has TOTP Reuse During Validity Window

Published 21 Sep 2026

Follow this CVE + Monitor nginx-ignition + Monitor github.com/lucasdillmann/nginx-ignition

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.2epss 0.4%

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Affected products

lucasdillmann · nginx-ignition

Related CVEs — lucasdillmann nginx-ignition

In the same product, most dangerous first.

CVE-2026-61628HIGHnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionEPSS 0.4%CVE-2026-61629HIGHnginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewareEPSS 0.4%

References

https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107 https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f