{"id":"CVE-2026-107808","kind":"vulnerability","aliases":["CVE-2026-107808","GHSA-45gv-9wjv-xh7p","GO-2026-6704"],"related":[],"title":"Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.","summary":"Nginx UI, a web interface for managing Nginx, skips its passkey second factor on password login for accounts that use only a passkey. An attacker who has the account password can log in and reach administrative functions without the passkey.","severity":"high","cvss":8.1,"epss":0.00413,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728074558-95cd21b70814"],"affected":">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["managed-hosting","totp-configured-accounts","version-2.5.0-or-later","version-before-2.0.0"],"how_to_check":"Check whether the Go module github.com/0xJacky/Nginx-UI is in your build, for example with 'go list -m github.com/0xJacky/Nginx-UI' or by checking the version in go.mod.\nIf you run Nginx UI 2.0.0 through 2.4.x, treat it as exposed, and check whether any account has only a passkey and no TOTP configured.","fix":"Upgrade Nginx UI to 2.5.0 or later (Go module version 1.9.10-0.20260728074558-95cd21b70814 or newer).\nUntil you upgrade, rotate passwords for accounts that rely on passkeys and restrict access to the login endpoint.","status":"open","published_at":"2026-10-09T16:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:48+00:00","updated_at":"2026-10-23T19:52:48+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:52:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Nginx UI to 2.5.0 or later (Go module version 1.9.10-0.20260728074558-95cd21b70814 or newer).\nUntil you upgrade, rotate passwords for accounts that rely on passkeys and restrict access to the login endpoint.","summary":"Nginx UI, a web interface for managing Nginx, skips its passkey second factor on password login for accounts that use only a passkey. An attacker who has the account password can log in and reach administrative functions without the passkey.","category":"package","who_cares":["nginx-ui","self-hosted","go","nginx"],"confidence":0.8,"analyst_note":"","how_to_check":"Check whether the Go module github.com/0xJacky/Nginx-UI is in your build, for example with 'go list -m github.com/0xJacky/Nginx-UI' or by checking the version in go.mod.\nIf you run Nginx UI 2.0.0 through 2.4.x, treat it as exposed, and check whether any account has only a passkey and no TOTP configured.","needs_analyst":false,"not_affected_if":["managed-hosting","version-before-2.0.0","version-2.5.0-or-later","totp-configured-accounts"],"severity_if_unknown":"high"},"cost_usd":0.000446,"input_tokens":2307,"output_tokens":431,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107808':24A,35A '-2026':23A,31A,34A '-6704':32A '/0xjacky/nginx-ui':21A,38A '/api/login':105C '2.0.0':101C '2.5.0':103C,173C '2fa':16A '45gv':27A '9wjv':28A 'account':65B,76B,129C,143C,158C 'administr':83B,161C 'assert':114C 'attack':72B,149C 'authent':3A 'bypass':4A,17A 'check':106C 'configur':124C 'cve':22A,33A 'despit':138C 'enabled2fa':139C 'enabledotp':107C 'enabledpasskey':116C 'enforc':9A 'factor':15A,60B,147C 'fix':170C 'function':84B,162C 'ghsa':26A 'ghsa-45gv-9wjv-xh7p':25A 'github.com':20A,37A 'github.com/0xjacky/nginx-ui':19A,36A 'go':30A,39B 'host':47B 'interfac':52B,94C 'issu':132C,168C 'log':79B 'login':6A,63B 'manag':54B 'nginx':1A,40B,42B,48B,55B,88C,97C 'nginx-ui':41B 'obtain':151C 'packag':44B 'passkey':12A,58B,70B,87B,127C,166C 'passkey-on':11A,126C 'password':5A,62B,77B,136C,153C 'post':104C 'reach':82B,160C 'regist':165C 'report':140C 'requir':111C 'second':14A,59B,146C 'secret':122C 'self':46B 'self-host':45B 'server':99C 'session':134C 'skip':56B 'take':155C 'therefor':131C 'totp':121C 'true':118C 'ui':2A,43B,49B,89C 'use':67B 'user':93C 'verif':137C 'version':172C 'web':51B,92C,98C 'webauthn':113C 'without':85B,163C 'xh7p':29A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6704","url":"https://pkg.go.dev/vuln/GO-2026-6704","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107808","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107808","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107808","severity":null,"published_at":"2026-10-09T16:17:25+00:00","modified_at":"2026-10-20T15:24:07+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}