DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61630: CVE-2026-61630: Time-Based One-Time Password (TOTP) Reuse/Replay in nginx-ignition

#security #cve #cybersecurity

CVE-2026-61630: Time-Based One-Time Password (TOTP) Reuse/Replay in nginx-ignition

Vulnerability ID: CVE-2026-61630
CVSS Score: 4.2
Published: 2026-09-21

nginx-ignition is a web-based user interface for managing the Nginx web server. In versions 2.33.0 through 2.35.0, the application is vulnerable to an improper authentication flaw (CWE-287) in its Multi-Factor Authentication (MFA) implementation. The stateless validation of Time-Based One-Time Passwords (TOTP) allows an attacker to reuse a captured, active verification code multiple times within the standard 30-second validity window, successfully bypassing secondary authentication checks if primary credentials are known.

TL;DR

A replay vulnerability in nginx-ignition allows attackers with primary credentials to reuse a valid, active 2FA TOTP code within its 30-second window to gain full administrative access.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287 (Improper Authentication)
  • Attack Vector: Network
  • CVSS v3.1 Score: 4.2 (Medium)
  • Exploit Status: Proof-of-Concept / Methodology Validated
  • CISA KEV Status: Not Listed
  • Attack Complexity: High
  • Privileges Required: High

Affected Systems

  • nginx-ignition installations running versions v2.33.0 through v2.35.0
  • nginx-ignition: >= v2.33.0, <= v2.35.0 (Fixed in: v2.35.1)

Code Analysis

Commit: 8d35e1e

Implement database constraints and tracking for the last used TOTP codes in user authentication repository.

Added state tracking database columns to store arrays of previously verified strings and implemented query checking logic to deny repeated tokens during authentication step.
Enter fullscreen mode Exit fullscreen mode

Commit: 1cbfae0

Refactor MFA logic and prepare structural models for stateful TOTP validation workflows.

Modified the TOTP structural definitions inside the core user logic files to hold slice elements storing previously utilized token signatures.
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade nginx-ignition to version 2.35.1 or newer.
  • Ensure all administrative traffic to the portal uses TLS/HTTPS with HSTS enabled to prevent packet sniffing.
  • Restrict dashboard access to trusted IP ranges or VPN tunnels.

Remediation Steps:

  1. Identify the running version of nginx-ignition by checking the deployment configuration, release tag, or the go.mod dependencies.
  2. Retrieve the updated container image or pull the latest source code tag v2.35.1.
  3. Rebuild and redeploy the application, ensuring that database schema migrations execute successfully to apply the updated table columns.
  4. Verify the configuration by logging in as an administrator and attempting to reuse a freshly validated 2FA code in an adjacent session.

References

Read the full report for CVE-2026-61630 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)