CVE-2026-84315

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Published Oct 12, 2026 · corrected/updated Oct 15, 2026 · 0xJacky nginx-ui · evidence confidence high

Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. rejects an OTP-enabled user's request unless the request includes a valid issued after a fresh OTP/passkey verification. The project already applies this step-up middleware to sensitive operations such as: - Nginx config create/edit/rename/delete; - site save/delete/enable/disable/rename/duplicate; - stream save/delete/enable/disable/rename/duplicate; - settings save and protected secret reads; - backup restore. However, several similarly sensitive authenticated mutation routes remain outside . An attacker who obtains an authenticated JWT/session for a 2FA-enabled user, but does not have the victim's fresh OTP/passkey secure-session token, can still perform those operations. The affected route groups include: - automatic backup create/modify/delete/restore/test-S3 operations; - DNS credential create/edit/delete operations; - certificate and ACME user create/modify/delete/register operations; - DNS domain, record, and DDNS create/update/delete operations; - Nginx reload/restart, stub-status toggle, performance-setting update, and module-cache refresh operations; - site/stream advanced-mode toggles and batch updates; - auto-certificate binding/unbinding for sites; - site navigation order and health-check updates. This report is distinct from my earlier Nginx UI report about auto-backup path traversal. This report is about missing 2FA step-up authorization on sensitive authenticated mutation routes. ## Why this is a security boundary only requires a secure-session token for users with OTP enabled. For OTP

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-84315 is a high public vulnerability record for 0xJacky nginx-ui. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether 0xJacky nginx-ui is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: github.com/0xJacky/Nginx-UI (0 → 1.9.10-0.20260703131214-23d1934099b0); github.com; 0xJacky nginx-ui. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 8.3. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-862. Sources contributing to this record: cve_org, github, gitlab, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Technology hubs

Nginx

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 15, 2026 · GitHub Advisory Database
Detected
Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OT
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0
Oct 15, 2026 · GitHub Advisory Database
Updated
Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OT

Affected

Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260703131214-23d1934099b0
golang github.comversion unspecified
vendor 0xJacky nginx-uiversion unspecified

Sources

CVE.orgVulnerability recordCVE-2026-84315
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen auth
cve.org
GitHub Advisory DatabasePackage advisoryGHSA-5v7c-xpfp-p65m
GitHub Advisory Database record mirrored by OSV.
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-84315
Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. RequireSecureSession() rejects an OTP-enabled user's request unless the request includes a valid X-Secure-Session-ID issued after a fresh OTP/passkey verification. The project already applies this step-up middleware to sensitive operations such as: Nginx config create/edit/rename/delete; site save/
advisories.gitlab.com
OSV.devPackage advisoryGHSA-5v7c-xpfp-p65m
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
osv.dev