UBUNTU-CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

GHSA-HF33-Q6CF-C66F nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61630

nginx ignition (a web user interface for nginx) in versions 2.33.0 through 2.35.0 allows any user who has enabled OTP 2FA to have their TOTP token reused during the standard 30-second validity window. The issue is fixed in version 2.35.1 . The CVSS 3.1 score is 4.2 (MEDIUM) , reflecting high atta...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

EUVD-2026-83922

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61630: Improper Authentication

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

Linux Distros Unpatched Vulnerability : CVE-2026-82470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp...

CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth (a Ruby authentication library) before 2.47.0 contains a TOTP code reuse vulnerability in its otp feature. The root cause is a failure to track the last accepted code timestamp, allowing an attacker who observes a valid time-based one-time password to replay it within the drift window and...

SUSE CVE-2025-6015

Vault and Vault Enterprise's “Vault” login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

gitea -- multiple vulnerabilities

The Gitea team reports: CVE-2026-27783: incorrect read permission check CVE-2026-25714: public-only token filtering bypass CVE-2026-20706: missing token scope checking CVE-2026-27771: unauthenticated access to private container images CVE-2026-28744: git smart HTTP request scope bug CVE-2026-2869...

CVE-2026-33473 Vikunja has TOTP Reuse During Validity Window

Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue...