CVE-2026-61630: nginx ignition has TOTP Reuse During Validity Window
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nginx ignitionto a version that resolves this vulnerability.Fixed in 2.35.1
Event History
Frequently Asked Questions
Which deployments are affected?
nginx ignition versions 2.33.0 through 2.35.0 are affected for users who have enabled OTP-based two-factor authentication. Version 2.35.1 patches the issue.
What would an attacker need to exploit this?
The attacker would need a valid TOTP value for an affected user and would need to reuse it within the standard 30-second TOTP validity window. The supplied CVSS vector also indicates high privileges, user interaction, and high attack complexity are required.
How can I determine whether I am exposed?
Check the deployed nginx ignition version and whether users have OTP 2FA enabled. Instances running versions 2.33.0 through 2.35.0 with OTP-enabled users should be treated as affected.
What is the remediation?
Upgrade nginx ignition to version 2.35.1, which patches TOTP reuse during the validity window.