nginx ignition has TOTP Reuse During Validity Window
Priority LOW 20CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00381 32nd percentileScored 2026-11-07
Fix Fixed nginx-ignition (lucasdillmann): 2.35.1github.com/lucasdillmann/nginx-ignition (Go): 0.0.0-20260328015550-8d35e1eb5dd6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lucasdillmann | nginx-ignition | 2.33.0 to before 2.35.1 | 2.35.1 | Patch available | CNA |
| — | github.com/lucasdillmann/nginx-ignition (Go) | 0.0.0-20260217145239-1cbfae0296f1 to before 0.0.0-20260328015550-8d35e1eb5dd6 | 0.0.0-20260328015550-8d35e1eb5dd6 | Patch available | GHSA-hf33-q6cf-c66f |
- nginx-ignition Vendorlucasdillmann Affected 2.33.0 to before 2.35.1 Fixed in 2.35.1 Patch available CNA
- github.com/lucasdillmann/nginx-ignition (Go) Vendor— Affected 0.0.0-20260217145239-1cbfae0296f1 to before 0.0.0-20260328015550-8d35e1eb5dd6 Fixed in 0.0.0-20260328015550-8d35e1eb5dd6 Patch available GHSA-hf33-q6cf-c66f
Remediation
- Fix · CNA nginx-ignition (lucasdillmann) Fixed in 2.35.1
- Fix · GHSA-hf33-q6cf-c66f github.com/lucasdillmann/nginx-ignition (Go) Fixed in 0.0.0-20260328015550-8d35e1eb5dd6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61630
- 2026-10-03 Alias added: GHSA-hf33-q6cf-c66f
References
Other 7
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f
- https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e
- https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107
- https://github.com/pquerna/otp/issues/61
- https://github.com/lucasdillmann/nginx-ignition/pull/104
- https://github.com/lucasdillmann/nginx-ignition
- https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.35.1
More lucasdillmann vulnerabilities
- TI-2026-44138 Resource allocation without limits in lucasdillmann nginx-ignition CVSS 3.1HIGH 7.5
- TI-2026-44137 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition CVSS 3.1HIGH 8.1
Sources
- CVE-2026-61630 · CVE Program
- CVE-2026-61630 · NVD
- FIRST EPSS
- GHSA-hf33-q6cf-c66f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences