ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-84315

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Published Oct 12, 2026 · catalog updated Oct 15, 2026 · 0xJacky

Check if you run it

No confirmed exploitation is on record for CVE-2026-84315. EPSS is 0.22%. Act only if a listed version of 0xJacky is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.22%
Remediation
Advisory link
Affected products
Go github.com/0xJacky/Nginx-UI · golang github.com · vendor 0xJacky nginx-ui

Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. rejects an OTP-enabled user's request unless the request includes a valid issued after a fresh OTP/passkey verification. The project already applies this step-up middleware to sensitive operations such as: - Nginx config create/edit/rename/delete; - site save/delete/enable/disable/rename/duplicate; - stream save/delete/enable/disable/rename/duplicate; - settings save and protected secret reads; - backup restore. However, several similarly sensitive authenticated mutation routes remain outside . An attacker who obtains an authenticated JWT/session for a 2FA-enabled user, but does not have the victim's fresh OTP/passkey secure-session token, can still perform those operations. The affected route groups include: - automatic backup create/modify/delete/restore/test-S3 operations; - DNS credential create/edit/delete operations; - certificate and ACME user create/modify/delete/register operations; - DNS domain, record, and DDNS create/update/delete operations; - Nginx reload/restart, stub-status toggle, performance-setting update, and module-cache refresh operations; - site/stream advanced-mode toggles and batch updates; - auto-certificate binding/unbinding for sites; - site navigation order and health-check updates. This report is distinct from my earlier Nginx UI report about auto-backup path traversal. This report is about missing 2FA step-up authorization on sensitive authenticated mutation routes. ## Why this is a security boundary only requires a secure-session token for users with OTP enabled. For OTP

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260703131214-23d1934099b0
  • golang github.comversion unspecified
  • vendor 0xJacky nginx-uiversion unspecified

How to fix CVE-2026-84315

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-84315. EPSS is 0.22%. Act only if a listed version of 0xJacky is installed.

Which versions are affected?

Compare what you have installed with github.com/0xJacky/Nginx-UI 0 → 1.9.10-0.20260703131214-23d1934099b0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-862: Missing Authorization. EPSS 0.22%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nginx security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OT

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OT

Sources

  • CVE.orgVulnerability recordCVE-2026-84315

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen auth

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-84315

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-5v7c-xpfp-p65m

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-84315

    Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. RequireSecureSession() rejects an OTP-enabled user's request unless the request includes a valid X-Secure-Session-ID issued after a fresh OTP/passkey verification. The project already applies this step-up middleware to sensitive operations such as: Nginx config create/edit/rename/delete; site save/

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-5v7c-xpfp-p65m

    Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.