Medium severity4.2NVD Advisory· Published Sep 21, 2026

CVE-2026-61630

Description

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lucasdillmann/Nginx Ignitionreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 2.33.0 - 2.35.0

Patches

Vulnerability mechanics

References

github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102envd
github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107nvd
github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66fnvd

News mentions

No linked articles in our index yet.

cvss	0.273
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000