CVE-2026-84313

Received Received - Intake

Authentication Bypass in Nginx UI via Session Hijacking

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84313

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Nginx UI before version 2.4.1 has a vulnerability where two API endpoints, POST /api/otp_enroll and POST /api/finish_passkey_register, do not require secure session verification. This allows an attacker with a stolen JWT to bind their own TOTP secret or register a passkey without the victim's password, creating persistent unauthorized account access even after a password change.

Detection Guidance

Check if your Nginx UI version is below 2.4.1 by running: curl -s http://localhost:port/api/version or inspect the application version in the web interface. Review server logs for POST requests to /api/otp_enroll or /api/finish_passkey_register without prior password verification.

Impact Analysis

If you use Nginx UI versions before 2.4.1, an attacker could gain long-term access to your account by exploiting this flaw. They could bypass authentication methods like TOTP or passkeys, maintain access even if you change your password, and potentially interfere with your legitimate login attempts.

Compliance Impact

This vulnerability could lead to unauthorized persistent access to user accounts, potentially violating data protection requirements under GDPR and HIPAA. Unauthorized access may result in unauthorized data disclosure or modification, which conflicts with principles of confidentiality and integrity required by these regulations.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later immediately. Rotate all JWT secrets and passwords for affected accounts. Monitor for unauthorized TOTP or passkey registrations in logs. Block suspicious POST requests to the vulnerable endpoints at the network level.

Hi! I’m here to help you understand CVE-2026-84313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70