CVE-2026-61630

MEDIUMCVSS 4.2

Description

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

Timeline

Published:September 21st, 2026 3:17 PM

Last modified:September 24th, 2026 9:25 PM

CVSS Scoring

CVSS v3: 4.2 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-287

References & Reports

Advisories, patches, and third-party reports

https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e
https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107
https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f

Source: NIST NVD · Data may lag official sources by up to one minute