---
id: "CVE-2026-84315"
kind: "vulnerability"
aliases: ["CVE-2026-84315", "GHSA-5v7c-xpfp-p65m", "GO-2026-6775"]
title: "Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI"
severity: "high"
cvss: 8.3
epss: 0.00275
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/0xJacky/Nginx-UI", "fixed": ["1.9.10-0.20260703131214-23d1934099b0"], "affected": "< 1.9.10-0.20260703131214-23d1934099b0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "nginx", "nginx-ui", "package", "self-hosted"]
not_affected_if: ["no-exposed-admin-ui", "users-without-otp"]
published_at: "2026-10-12T21:17:21+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:52:42+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6775", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-84315", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84315", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI

Nginx UI, a web interface for managing Nginx, skips its OTP/passkey step-up check on several sensitive routes such as backups, DNS credentials, certificates and Nginx control. An attacker holding a stolen logged-in session can change those settings without the second factor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/0xJacky/Nginx-UI affected < 1.9.10-0.20260703131214-23d1934099b0 fixed 1.9.10-0.20260703131214-23d1934099b0

## How to check

Check the version of github.com/0xJacky/Nginx-UI in your go.mod or the running binary; versions before 1.9.10-0.20260703131214-23d1934099b0 are affected per the Go vulnerability database.

## Fix

Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260703131214-23d1934099b0 or later (the description says 2.4.1 or later).
After upgrading, rotate sessions for users who have OTP enabled if exposure is suspected.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6775
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-84315
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84315

## From the sources

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_