nginx ignition allows a user who has enabled OTP 2FA to reuse the same TOTP code for any authentication attempts made within the standard 30‑second validity period. This flaw permits an attacker who obtains a valid OTP to log in multiple times without a fresh code, bypassing the intended two‑factor protection. The effect is a loss of authentication integrity but does not expose resources beyond the privileges of the compromised user.

This vulnerability applies to the lucasdillmann:nginx-ignition product, versions 2.33.0 through 2.35.0 inclusive. Version 2.35.1 includes the fix.

The CVSS score of 4.2 classifies the issue as low severity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, indicating it is not a widely exploited vulnerability. The attack likely requires an adversary to know or capture a valid TOTP code during the 30‑second window; exploitation then proceeds by presenting the same code repeatedly. Because the window is short, successful exploitation may be limited to brief sessions or opportunistic use of recorded OTPs.