CVE-2026-84315

Received Received - Intake

Authentication Bypass in Nginx UI via Session Hijacking

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84315

EUVD

EUVD-2026-97830

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Nginx UI before version 2.4.1 fails to enforce secure session requirements for authenticated mutation routes. This allows attackers with a stolen session to perform sensitive actions like modifying backups, DNS records, certificates, or Nginx settings without completing additional authentication steps such as OTP or passkey verification.

Detection Guidance

Check if your Nginx UI version is below 2.4.1. Review authenticated mutation routes for missing RequireSecureSession enforcement. Inspect session handling for X-Secure-Session-ID validation gaps.

Impact Analysis

If you use Nginx UI versions prior to 2.4.1, an attacker could hijack your authenticated session and alter critical configurations or data without your knowledge. This could lead to unauthorized changes in your web server setup, security settings, or backup systems, potentially causing service disruptions or security breaches.

Compliance Impact

This vulnerability could lead to unauthorized modifications of sensitive data or configurations, potentially violating compliance requirements for data integrity and access control under standards like GDPR or HIPAA. Unauthorized changes may result in data breaches or loss of audit trails.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later. Ensure all authenticated mutation routes enforce RequireSecureSession. Rotate credentials and session tokens if a breach is suspected.

Hi! I’m here to help you understand CVE-2026-84315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70