Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429 Patch
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p Exploit, Vendor Advisory, Mitigation
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p Exploit, Vendor Advisory, Mitigation
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 3
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 15:24
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-20 15:24
- First seenCVSS 8.1NVD modified 2026-10-09 18:17
Affected (CPE criteria) 1
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*
References 4
- https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429 Patch
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 Release Notes
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p Exploit, Vendor Advisory, Mitigation
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p Exploit, Vendor Advisory, Mitigation