{"id":"CVE-2026-84313","published":"2026-10-12T21:17:21.597","lastModified":"2026-10-15T14:17:29.597","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w","tags":[]}],"exploitRefs":[{"url":"https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w","tags":[]},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w","tags":[]}],"hasPoc":true,"ai":{"summary":"Nginx UI allows attackers with stolen JWT tokens to bypass password verification during TOTP enrollment and passkey registration, creating persistent backdoor access that survives password changes. This affects both new and existing user accounts.","exploitability":"Moderately easy to exploit with a stolen JWT token, requiring only access to the affected API endpoints without needing the victim's current password.","blast_radius":"A successful exploitation can grant attackers persistent access to victim accounts that remains valid even after password changes, potentially affecting multiple users across the Nginx UI instance.","remediation":"Upgrade to version 2.4.1 or later to fix the authentication bypass in OTP enrollment and passkey registration endpoints.","detection":"Monitor for POST requests to /api/otp_enroll and /api/finish_passkey_register endpoints with valid JWT tokens but without corresponding password verification logs, particularly when these requests occur outside of normal user session patterns.","tags":["auth-bypass","jwt","web","session"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:58:02.473Z"}}