CVE-2026-84313
Nginx UI is a web user interface for the Nginx web server.
Published Oct 12, 2026 · corrected/updated Oct 15, 2026 · evidence confidence high
## Summary Endpoints that bind a TOTP secret ( ) or register a WebAuthn passkey ( ) for the *current* user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered **outside** the group. With only a stolen JWT, an attacker can attach their own second factor to the victim's account, surviving any subsequent password rotation and locking the legitimate user out. ## Details — note the routes registered *before* the secure-session group: ( ) only refuses if is already ; for any victim who has never enabled TOTP it accepts an attacker-supplied and pair (the validator only checks that the passcode is a valid TOTP for the supplied secret — i.e., the attacker proves they know the secret they are submitting): ( ) is structurally identical and additionally has *no* "already enrolled" guard — an attacker can register multiple passkeys to the victim. ## Proof of Concept Now whenever the legitimate user (or anyone) logs in to that account, the second factor must be supplied from the *attacker's* authenticator. The passkey variant follows the same pattern: then with the attacker's WebAuthn authenticator. The route is also outside . ## Impact * Persistent account takeover surviving the victim's password reset. * Combines trivially with any of: stolen JWT, the bypass, the missing-role-model privilege escalation, and the weak recovery-code generation. ## Patches — move enrolment routes inside the secure-session group: This patch alone is **not sufficient** — the middleware is a no-op for non-OTP users (separate advisory). Both must be patched together. Additionally, require the user's current password in the request body for these mutations (mirroring at ). ## Workarounds None reliable. Operators should monitor the table for unexpected values and the table for unexpected rows. ## Credits Vishal Shukla ([@shukla304](https://github.com/shukla304)) and Sechub.dev AI Agent.
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-84313 is a high public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: Nginx-UI (0 → 1.9.10-0.20260703131214-23d1934099b0). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 8.8. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-287, CWE-306. Sources contributing to this record: cve_org, github, nvd, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 12, 2026 · NIST NVD
Detected
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an a
Oct 15, 2026 · NIST NVD
Updated
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an a
Oct 15, 2026 · GitHub Advisory Database
Fix available
Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0
Oct 15, 2026 · GitHub Advisory Database
Fix available
Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0
Oct 15, 2026 · GitHub Advisory Database
Updated
## Summary Endpoints that bind a TOTP secret ( ) or register a WebAuthn passkey ( ) for the *current* user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered **outside** the group. With only a stolen JWT, an attacker can attach their own second factor to the victim's account, surviving any subsequent password rotation and locking the legitimat
Affected
- Go Nginx-UI0 → 1.9.10-0.20260703131214-23d1934099b0
Sources
- CVE.orgVulnerability recordCVE-2026-84313
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-gfrc-g87h-7h5w
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-84313
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a s
nvd.nist.gov - OSV.devPackage advisoryGHSA-gfrc-g87h-7h5w
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
osv.dev