CVE-2026-61630

Executive Summary

CVE-2026-61630 is an authentication weakness in nginx ignition, a user interface for the nginx web server, affecting versions 2.33.0 through 2.35.0. The flaw resides in the Time-based One-Time Password (TOTP) second-factor authentication flow: a TOTP value, once used, remains valid for the standard 30-second validity window, allowing the same one-time code to be reused within that period rather than being invalidated after first use. The issue is resolved in version 2.35.1; no public exploit, PoC code, or Nuclei template has been observed, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The vulnerability is classified as CWE-287: Improper Authentication, with specific reference to failing to invalidate a one-time credential after its initial consumption. nginx ignition supports OTP-based two-factor authentication (2FA). Under the correct implementation of TOTP (RFC 6238), each generated code is valid for a single 30-second time step; a robust implementation rejects a code that has already been accepted during the current window to prevent replay.

In the affected versions (2.33.0 through 2.35.0), any user who has enabled OTP 2FA can have their TOTP reused during the standard 30-second validity window. In other words, once an attacker has observed or captured a valid TOTP — for example through a real-time phishing proxy, a man-in-the-middle position on an unencrypted or intercepted session, or by shoulder-surfing a code entry — that code remains usable until the 30-second step expires. The target application does not enforce single-use semantics for an accepted OTP, so the same code can satisfy a subsequent authentication attempt within that same window.

Because TOTP codes are derived from a shared secret and the current time, the weakness is not a brute-force or code-prediction problem; it is a credential-replay problem. The attack surface is the 2FA verification step of the nginx ignition login flow, which is reachable over the network. The primary constraint is timing: the attacker must present the captured code before the 30-second window closes, which is why AC:H (High attack complexity) is assigned in the CVSS vector. The PR:H (High privileges) rating reflects that the attacker must have already obtained valid primary credentials or otherwise reached the 2FA stage, and UI:R (User Interaction Required) reflects that a legitimate user must initiate or be induced into an authentication flow for the code to be generated and observed.

The confidentiality impact is rated High (C:H) because successful reuse leads to unauthorized authenticated session establishment, exposing whatever data and administrative functions that user account can access. Integrity and availability impacts are rated None (I:N/A:N) because the described mechanism does not directly allow modification or disruption of data — though reconnaissance and lateral movement following authentication remain possible. The overall CVSS score is 4.2.

No code-level detail beyond the description above is available for this CVE. The NVD description does not identify specific functions, endpoints, or parameters involved in the OTP validation logic, and no CNA title was provided. The analysis is therefore limited to the vulnerability class (one-time credential replay within the TOTP validity window) and the mechanism stated in the description.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-61630. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no specific function names, endpoints, or parameters beyond those stated in the source data are asserted.

1. Reconnaissance / target identification. The attacker identifies an nginx ignition deployment running a vulnerable version (2.33.0 through 2.35.0) whose target user has OTP 2FA enabled. Public-facing login interfaces can be located through web searches for the product name and its login page. The attacker also needs an avenue to observe or capture a TOTP value generated for a legitimate user session.

2. Triggering the flaw class. The attacker obtains a valid TOTP for the target account. This could be achieved through a real-time adversary-in-the-middle phishing framework that relays credentials and the subsequent OTP prompt, through interception of traffic if the OTP transmission is not adequately protected, or through direct observation of a user's code entry. The critical property is that the captured code has not yet left its 30-second validity window.

3. Reuse of the captured OTP. Instead of being limited to a single use, the captured TOTP can be resubmitted to the authentication flow within the remainder of the 30-second window. Because the application does not reject an already-accepted code, the attacker's authentication attempt succeeds using the same second factor the legitimate user just used. At the vulnerability-class level, this is a replay of a one-time credential that the implementation failed to invalidate after first consumption.

4. Post-exploitation impact. Successful reuse grants the attacker an authenticated session as the targeted user. Depending on that user's role in nginx ignition, the attacker may be able to view or alter web server configuration exposed through the UI, enumerate infrastructure, and use the foothold for further access. No persistence or privilege-escalation behavior specific to this CVE is described in the available data.

Note: the practical window is 30 seconds, so exploitation requires tight timing or automated real-time relay tooling. This constraint aligns with the High attack complexity rating.

Impact Assessment

The blast radius is limited to nginx ignition deployments in versions 2.33.0 through 2.35.0 where OTP 2FA is enabled for user accounts. The flaw defeats the security guarantee of the second factor for those accounts during the validity window, effectively reducing the strength of 2FA to that of a replayable credential.

Directly affected assets are the nginx ignition management/UI surface and, by extension, the managed nginx web server infrastructure that the UI governs. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N yields a base score of 4.2 (Medium). Breaking this down: Network attack vector (the login/2FA interface is remotely reachable), High attack complexity (requires capturing a live code and replaying within 30 seconds), High privileges required (attacker must already possess primary credentials or equivalent access to the 2FA stage), User Interaction required (a legitimate user must generate the code being replayed), and no scope change — impact stays within the security authority of the vulnerable component. Confidentiality is High because authentication as the victim opens access to data and functions; integrity and availability are None because the described mechanism itself neither modifies nor disrupts data.

Business impact includes weakened assurance in multi-factor authentication, potential unauthorized access to web infrastructure administration, and compliance implications for environments where 2FA is a control requirement. The absence of public exploit code and KEV listing indicates a lower immediate operational urgency, but the flaw's nature — undermining a security control — warrants attention in any environment exposing nginx ignition to untrusted networks.

Detection Guidance

No public exploit artifacts exist, so the detection content below targets the behavioral signature of the flaw: repeated acceptance/use of a TOTP within a single 30-second time window, and the authentication patterns associated with real-time OTP relay. The rules are illustrative starting points and must be tuned to the deployment's logging schema and field names.

Sigma Rule

title: Potential TOTP Replay in nginx ignition 2FA
id: 8f2c1b40-6d5e-4a7b-9c31-ignition2fa01
status: experimental
description: Detects multiple successful or attempted 2FA OTP submissions for the same account within a single TOTP validity window (30 seconds), consistent with CVE-2026-61630.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61630
author: valtersit.com
date: 2026/01/01
logsource:
  product: nginx_ignition
  service: authentication
detection:
  selection:
    event_type: 'otp_verification'
  timeframe: 30s
  condition: selection | count() by user > 1
fields:
  - user
  - src_ip
  - timestamp
falsepositives:
  - Legitimate user retrying a mistyped code within the same window
level: medium

YARA Rule

rule CVE_2026_61630_nginx_ignition_totp_replay
{
    meta:
        description = "Detects log or artifact traces indicating nginx ignition OTP reuse within the TOTP validity window (CVE-2026-61630)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61630"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "nginx ignition" nocase
        $b = "otp" nocase
        $c = "totp" nocase
        $d = "2fa" nocase

    condition:
        $a and (2 of ($b, $c, $d))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-61630 Possible nginx ignition TOTP Replay (2FA OTP reuse)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"otp"; nocase; http.header; content:"nginx ignition"; nocase; threshold:type both, track by_src, count 2, seconds 30; classtype:attempted-recon; sid:202661630; rev:1; reference:cve,2026-61630; metadata:service http;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ authentication where event.action == "otp_verification" and event.outcome == "success" ]
  [ authentication where event.action == "otp_verification" ]

Splunk SPL Query

index=nginx_ignition sourcetype=ignition:auth action="otp_verify"
| bin _time span=30s
| stats count as otp_attempts, dc(src_ip) as unique_ips, values(src_ip) as source_ips by user, _time
| where otp_attempts > 1
| table _time, user, otp_attempts, unique_ips, source_ips

Wazuh OSSEC Rule

<group name="nginx_ignition,authentication,">
  <rule id="100630" level="10" frequency="2" timeframe="30">
    <if_matched_sid>100629</if_matched_sid>
    <same_field>user</same_field>
    <description>CVE-2026-61630: Repeated OTP 2FA verification for the same nginx ignition user within 30 seconds - possible TOTP replay.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="100629" level="0">
    <decoded_as>json</decoded_as>
    <field name="action">otp_verify</field>
    <description>nginx ignition OTP verification event.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found across tracked sources, despite the description stating that version 2.35.1 addresses the issue. Until vendor patch artifacts are independently confirmed in the environment's package supply chain, treat deployments as unpatched and rely on compensating controls.

1. Immediate mitigations.

   • Restrict network access to the nginx ignition UI and its authentication endpoints to trusted management networks, VPN, or zero-trust access proxies, reducing the exposure surface over which an attacker could capture a live TOTP.
   • Where feasible, prefer phishing-resistant second factors (FIDO2/WebAuthn hardware tokens) over TOTP for accounts that administer nginx ignition; these mechanisms bind authentication to the origin and are not subject to TOTP replay.
   • Enforce rate limiting on the 2FA verification endpoint and alert on multiple OTP submissions for a single account within a 30-second window (see Detection Guidance).
   • Monitor for real-time adversary-in-the-middle phishing patterns, which are the most realistic means of capturing a TOTP within its validity window.

2. Patch/upgrade steps.

   • Upgrade nginx ignition to version 2.35.1, which the NVD description identifies as the release that patches the issue.
   • Verify the integrity of the update through the vendor's official distribution channel and confirm the deployed version after upgrade.
   • Because patch confidence from tracked sources is currently 0/4, independently validate that 2.35.1 enforces single-use OTP semantics in the environment before relying on it as the sole control.

3. Long-term hardening.

   • Implement server-side single-use enforcement for all one-time credentials: an accepted OTP must be invalidated immediately, independent of the remaining time in its validity window.
   • Adopt standards-based, replay-resistant authentication (FIDO2/WebAuthn) for administrative interfaces.
   • Maintain an inventory of externally exposed administrative UIs and include nginx ignition version tracking in vulnerability management.
   • Log all 2FA events with sufficient fidelity (user, source IP, timestamp, outcome) to support the 30-second correlation detections above.

References

• NVD — CVE-2026-61630: https://nvd.nist.gov/vuln/detail/CVE-2026-61630
• MITRE CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• RFC 6238 — TOTP: Time-Based One-Time Password Algorithm: https://datatracker.ietf.org/doc/html/rfc6238
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-61630 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for CVE-2026-61630): https://www.first.org/epss/

Threat actor campaigns: none identified in the available data. Exploit-in-the-wild evidence: none observed. No public PoC, exploit code, or Nuclei template is associated with this CVE at the time of writing.