https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 22 Sep 2026 22:47:52 +0000 https://vulnerability.circl.lu/sighting/54d8c7c0-d891-4d1e-91f2-0d31812c7e59/export {"uuid": "54d8c7c0-d891-4d1e-91f2-0d31812c7e59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61630", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mw3yoj2ajx2b", "content": "CVE-2026-61630: nginx-ignition, an open-source web UI for nginx by lucasdillmann, allows a TOTP two-factor code to be reused within its 30-second validity window on accounts with OTP 2FA enabled. Fixed in version 2.35.1. No exploitation confirmed.", "creation_timestamp": "2026-09-22T10:16:30.262004Z"} {"uuid": "54d8c7c0-d891-4d1e-91f2-0d31812c7e59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61630", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mw3yoj2ajx2b", "content": "CVE-2026-61630: nginx-ignition, an open-source web UI for nginx by lucasdillmann, allows a TOTP two-factor code to be reused within its 30-second validity window on accounts with OTP 2FA enabled. Fixed in version 2.35.1. No exploitation confirmed.", "creation_timestamp": "2026-09-22T10:16:30.262004Z"} https://vulnerability.circl.lu/sighting/54d8c7c0-d891-4d1e-91f2-0d31812c7e59/export Tue, 22 Sep 2026 10:16:30 +0000 https://vulnerability.circl.lu/sighting/fb164e94-cdfc-4e52-8726-c03e98b72f36/export {"uuid": "fb164e94-cdfc-4e52-8726-c03e98b72f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61630", "type": "seen", "source": "https://gist.github.com/alon710/9d98bc19a160c740db04b0c738bd9724", "content": "# CVE-2026-61630: CVE-2026-61630: Time-Based One-Time Password (TOTP) Reuse/Replay in nginx-ignition\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-09-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61630\n\n## Summary\nnginx-ignition is a web-based user interface for managing the Nginx web server. In versions 2.33.0 through 2.35.0, the application is vulnerable to an improper authentication flaw (CWE-287) in its Multi-Factor Authentication (MFA) implementation. The stateless validation of Time-Based One-Time Passwords (TOTP) allows an attacker to reuse a captured, active verification code multiple times within the standard 30-second validity window, successfully bypassing secondary authentication checks if primary credentials are known.\n\n## TL;DR\nA replay vulnerability in nginx-ignition allows attackers with primary credentials to reuse a valid, active 2FA TOTP code within its 30-second window to gain full administrative access.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 (Improper Authentication)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.2 (Medium)\n- **Exploit Status**: Proof-of-Concept / Methodology Validated\n- **CISA KEV Status**: Not Listed\n- **Attack Complexity**: High\n- **Privileges Required**: High\n\n## Affected Systems\n\n- nginx-ignition installations running versions v2.33.0 through v2.35.0\n- **nginx-ignition**: >= v2.33.0, <= v2.35.0 (Fixed in: `v2.35.1`)\n\n## Mitigation\n\n- Upgrade nginx-ignition to version 2.35.1 or newer.\n- Ensure all administrative traffic to the portal uses TLS/HTTPS with HSTS enabled to prevent packet sniffing.\n- Restrict dashboard access to trusted IP ranges or VPN tunnels.\n\n**Remediation Steps:**\n1. Identify the running version of nginx-ignition by checking the deployment configuration, release tag, or the go.mod dependencies.\n2. Retrieve the updated container image or pull the latest source code tag v2.35.1.\n3. Rebuild and redeploy the application, ensuring that database schema migrations execute successfully to apply the updated table columns.\n4. Verify the configuration by logging in as an administrator and attempting to reuse a freshly validated 2FA code in an adjacent session.\n\n## References\n\n- [GHSA-hf33-q6cf-c66f: TOTP 2FA Replay vulnerability in nginx-ignition](https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f)\n- [Fix Commit: MFA Logic & Database Migrations](https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107)\n- [Fix Commit: Test Refactoring](https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e)\n- [Pull Request #104 - MFA Replay Security Fix](https://github.com/lucasdillmann/nginx-ignition/pull/104)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-61630)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61630) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T00:31:44.665328Z"} {"uuid": "fb164e94-cdfc-4e52-8726-c03e98b72f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61630", "type": "seen", "source": "https://gist.github.com/alon710/9d98bc19a160c740db04b0c738bd9724", "content": "# CVE-2026-61630: CVE-2026-61630: Time-Based One-Time Password (TOTP) Reuse/Replay in nginx-ignition\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-09-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61630\n\n## Summary\nnginx-ignition is a web-based user interface for managing the Nginx web server. In versions 2.33.0 through 2.35.0, the application is vulnerable to an improper authentication flaw (CWE-287) in its Multi-Factor Authentication (MFA) implementation. The stateless validation of Time-Based One-Time Passwords (TOTP) allows an attacker to reuse a captured, active verification code multiple times within the standard 30-second validity window, successfully bypassing secondary authentication checks if primary credentials are known.\n\n## TL;DR\nA replay vulnerability in nginx-ignition allows attackers with primary credentials to reuse a valid, active 2FA TOTP code within its 30-second window to gain full administrative access.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 (Improper Authentication)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.2 (Medium)\n- **Exploit Status**: Proof-of-Concept / Methodology Validated\n- **CISA KEV Status**: Not Listed\n- **Attack Complexity**: High\n- **Privileges Required**: High\n\n## Affected Systems\n\n- nginx-ignition installations running versions v2.33.0 through v2.35.0\n- **nginx-ignition**: >= v2.33.0, <= v2.35.0 (Fixed in: `v2.35.1`)\n\n## Mitigation\n\n- Upgrade nginx-ignition to version 2.35.1 or newer.\n- Ensure all administrative traffic to the portal uses TLS/HTTPS with HSTS enabled to prevent packet sniffing.\n- Restrict dashboard access to trusted IP ranges or VPN tunnels.\n\n**Remediation Steps:**\n1. Identify the running version of nginx-ignition by checking the deployment configuration, release tag, or the go.mod dependencies.\n2. Retrieve the updated container image or pull the latest source code tag v2.35.1.\n3. Rebuild and redeploy the application, ensuring that database schema migrations execute successfully to apply the updated table columns.\n4. Verify the configuration by logging in as an administrator and attempting to reuse a freshly validated 2FA code in an adjacent session.\n\n## References\n\n- [GHSA-hf33-q6cf-c66f: TOTP 2FA Replay vulnerability in nginx-ignition](https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f)\n- [Fix Commit: MFA Logic & Database Migrations](https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107)\n- [Fix Commit: Test Refactoring](https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e)\n- [Pull Request #104 - MFA Replay Security Fix](https://github.com/lucasdillmann/nginx-ignition/pull/104)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-61630)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61630) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T00:31:44.665328Z"} https://vulnerability.circl.lu/sighting/fb164e94-cdfc-4e52-8726-c03e98b72f36/export Tue, 22 Sep 2026 00:31:44 +0000