Description

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-21T15:17:30.650Z",
  "pubdate": "2026-09-21T15:17:30.650Z",
  "executiveSummary": "A replay vulnerability exists in the nginx ignition user interface for the nginx web server, affecting versions 2.33.0 through 2.35.0.\nThe flaw specifically resides in the implementation of Time-based One-Time Password (TOTP) two-factor authentication, where a successfully utilized TOTP token remains valid for multiple authentication attempts within the standard 30-second synchronization window.\nThis vulnerability allows an attacker who has intercepted a valid TOTP token to perform a replay attack, effectively bypassing the intended single-use security constraint of the multi-factor authentication mechanism.\nThe impact is a significant reduction in the security assurance provided by 2FA, potentially allowing unauthorized access to protected accounts if an attacker gains possession of a valid credential set and a used TOTP code.\nExploitation is limited to the timeframe of the TOTP validity window and requires the attacker to have already compromised primary authentication factors or intercepted the token through man-in-the-middle (MITM) or similar observation techniques.\nThe vulnerability is resolved in version 2.35.1.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement a robust 'used-token' blacklist or a stateful verification mechanism within the nginx ignition authentication module. In standard TOTP implementations (RFC 6238), a token is valid for a specific time step; however, once a token has been validated for a successful login, it should be marked as consumed to prevent replay attacks within that same time slice.\nIn the affected versions (2.33.0 through 2.35.0), the application logic fails to track the consumption status of TOTP tokens within the 30-second window. Consequently, if a user provides a valid TOTP code to authenticate, the underlying session management does not invalidate that specific code for the remainder of that time step.\nThe attack flow proceeds as follows: First, an attacker obtains a victim's valid primary credentials (e.g., username and password). Second, the attacker must capture a valid TOTP token generated by the victim, likely through an intercepting proxy, packet sniffing on an insecure connection, or social engineering. Third, the attacker initiates a login request to the nginx ignition interface using the victim's credentials. Fourth, within the 30-second window during which the captured TOTP token remains cryptographically valid, the attacker submits the same token used by the victim or a previously captured valid token. The authentication backend, lacking a mechanism to verify if the token was already processed, accepts the input as valid.\nThis vulnerability effectively renders the MFA component a simple shared secret mechanism rather than a secure, non-replayable authentication factor. Because TOTP tokens are time-bound, the attack surface is limited to the current 30-second drift window, but it eliminates the 'one-time' security property of the system. Successful exploitation results in account takeover, granting the attacker the same privileges and access rights associated with the compromised user account. The vulnerability is triggered during the authentication phase of the user interface and persists as long as the backend fails to implement a unique transaction ID or a stateful 'last used' counter for tokens."
}