CVE-2026-61630mediumCWE-287

CVE-2026-61630: fallo de gravedad media en lucasdillmann nginx-ignition

nginx ignition has TOTP Reuse During Validity Window

Publicada el

Seguir esta CVE+ Monitorear nginx-ignition+ Monitorear github.com/lucasdillmann/nginx-ignition

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.2epss 0.4%
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Productos afectados
lucasdillmann · nginx-ignition
CVEs relacionadas — lucasdillmann nginx-ignition

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-61628HIGHnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionEPSS 0.4%CVE-2026-61629HIGHnginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewareEPSS 0.4%