Live › vulnerability › CVE-2026-107808
Go to dashboardNginx UI, a web interface for managing Nginx, skips its passkey second factor on password login for accounts that use only a passkey. An attacker who has the account password can log in and reach administrative functions without the passkey.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814 | 1.9.10-0.20260728074558-95cd21b70814 |
go list -m github.com/0xJacky/Nginx-UI or by checking the version in go.mod2.0.0 through 2.4.x, treat it as exposed, and check whether any account has only a passkey and no TOTP configured2.5.01.9.10-0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107808")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.