CVE-2026-61630CWE-287

CVE-2026-61630

Medium · published September 21, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-21T19:17Z
References (3)
https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e · [email protected]https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107 · [email protected]https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f · [email protected]
EPSS history
Timeline
  • 23 SEP 03:47Z
    EPSS moved — → 0%
    epss
  • 21 SEP 14:17Z
    nginx ignition has TOTP Reuse During Validity Window
    cvelistv5