lucasdillmann vulnerabilities

Products

• github.com/lucasdillmann/nginx-ignition 3

Latest lucasdillmann CVEs

Newest publication first

1. CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

   Published 2026-09-21

   High·CVSS 8.1 EPSS 0.43%

   nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) patter...

2. CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

   Published 2026-09-21

   High·CVSS 7.5 EPSS 0.42%

   nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header wi...

3. CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

   Published 2026-09-21

   Medium·CVSS 4.2 EPSS 0.38%

   nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.