Live › vulnerability › CVE-2026-84313
Go to dashboardNginx UI, a web interface for managing Nginx, lets any holder of a valid login session bind an attacker-controlled TOTP secret or passkey to the account without re-entering the password. An attacker with a stolen JWT gets persistent account access that survives a password change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | all versions | – |
Check the Go module version of github.com/0xJacky/Nginx-UI in your go.mod or the running binary; anything below 2.4.1 is affected.
2.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-84313")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.