CVE-2026-61630mediumCWE-287

CVE-2026-61630: falha de média gravidade em lucasdillmann nginx-ignition

nginx ignition has TOTP Reuse During Validity Window

Publicada em

Seguir esta CVE+ Monitorar nginx-ignition+ Monitorar github.com/lucasdillmann/nginx-ignition

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.2epss 0.4%
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
lucasdillmann · nginx-ignition
CVEs relacionadas — lucasdillmann nginx-ignition

No mesmo produto, das mais perigosas para as menos.

CVE-2026-61628HIGHnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionEPSS 0.4%CVE-2026-61629HIGHnginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewareEPSS 0.4%