cve.bz

CVE-2026-61630

4.2 mediumEPSS 0.4%

Medium (4.2). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/lucasdillmann/nginx-ignition 0.0.0-20260328015550-8d35e1eb5dd6.

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

Severity

CVSS 3.1

4.2 medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hf33-q6cf-c66fGogithub.com/lucasdillmann/nginx-ignition>=0.0.0-20260217145239-1cbfae0296f1 <0.0.0-20260328015550-8d35e1eb5dd60.0.0-20260328015550-8d35e1eb5dd6
GO-2026-6537Gogithub.com/lucasdillmann/nginx-ignition>=0.0.0-20260217145239-1cbfae0296f1 <0.0.0-20260328015550-8d35e1eb5dd60.0.0-20260328015550-8d35e1eb5dd6

References

Check your stackJSON