EUVD-2026-83922
GHSA-hf33-q6cf-c66f
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Replay occurs at the pre-auth login boundary so PR:N (not PR:H); AC:H and UI:R reflect the need to intercept a live TOTP within 30s; successful login yields full account takeover, so C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
AnalysisAI
nginx-ignition versions 2.33.0 through 2.35.0 do not enforce single-use semantics on TOTP one-time codes, so a code that has already been used to authenticate can be replayed again within its normal 30-second validity window. Only accounts with OTP 2FA enabled are affected, and exploitation requires the attacker to already hold the victim's password plus a live-interception position (for example an adversary-in-the-middle phishing proxy) to capture the code as the victim types it, which is why the independent assessment treats this as a genuine but low-priority authentication weakness rather than an emergency. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following: (1) the victim account must have OTP/TOTP 2FA enabled - accounts without 2FA are unaffected by this specific replay flaw; (2) the attacker must already possess the victim's password; (3) the attacker must capture a valid TOTP code and replay it within the same 30-second validity window before it naturally expires; and (4) victim interaction is required (UI:R) - realistically a real-time phishing or adversary-in-the-middle proxy that harvests the code as the victim enters it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority authentication weakness, not a high-impact emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade nginx-ignition to 2.35.1 or later - the vendor-released patch that closes this TOTP replay window - and confirm the deployment actually runs the new build; the advisory GHSA-hf33-q6cf-c66f and the referenced upstream commits (1cbfae0, 8d35e1e) document the change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today