CVE-2026-102334 in Nginx Proxy Manager
Summary
by MITRE • 09/29/2026
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Nginx Proxy Manager versions up through 2.16.0 represents a critical authentication bypass mechanism rooted in the absence of rate-limiting controls on sensitive API endpoints. This architectural flaw allows unauthenticated actors to perform unlimited password guessing attempts against any user account without triggering standard security thresholds or lockout mechanisms. By exploiting this deficiency, attackers can systematically brute-force login credentials via the POST /api/tokens endpoint. The lack of throttling means that automated tools can submit thousands of credential combinations in a short timeframe, significantly increasing the probability of successfully compromising weak or reused passwords. This scenario is particularly dangerous because Nginx Proxy Manager often serves as a central gateway for internal and external web services, meaning that gaining access to this application provides a foothold into potentially critical infrastructure components.
Once an attacker successfully guesses valid credentials through the initial authentication endpoint, they are not immediately granted full administrative control but rather enter a state where further exploitation is required to escalate privileges or maintain persistent access. The vulnerability extends beyond simple password brute-forcing by also affecting two-factor authentication (2FA) verification processes. Specifically, the POST /api/tokens/2fa endpoint lacks similar rate-limiting protections. This allows an attacker who has obtained valid credentials to attempt unlimited guesses against Time-based One-Time Password codes. Since TOTP codes are typically six digits long and generated from a shared secret, the absence of account lockout or request throttling enables rapid offline-style brute-forcing within the application context. Successfully guessing the correct 2FA code grants the attacker full session access, effectively bypassing both password security and multi-factor authentication safeguards that were intended to provide layered defense in depth.
From an operational impact perspective, this vulnerability poses a severe risk to confidentiality, integrity, and availability of services managed by Nginx Proxy Manager. An authenticated adversary with administrative control can modify proxy configurations, redirect traffic to malicious servers, intercept sensitive data passing through the reverse proxy, or disable security headers that protect downstream applications. In many deployment scenarios, Nginx Proxy Manager is used to expose internal web applications to the internet; therefore, compromising this service could lead to a broader network compromise, including lateral movement into backend networks and exfiltration of confidential information stored in proxied services. The ease with which an attacker can automate these attacks due to the lack of rate limiting makes it highly likely that such vulnerabilities will be actively exploited by threat actors scanning for exposed management interfaces on the public internet.
This vulnerability aligns closely with CWE-307, Improper Restriction of Excessive Authentication Attempts, as the system fails to enforce appropriate limits on repeated authentication requests. It also maps to MITRE ATT&CK techniques such as T1110, Brute Force, specifically sub-techniques like T1110.001 for Password Guessing and potentially T1110.003 for Credential Stuffing if the attacker utilizes leaked credential databases. The exploitation path involves initial access via compromised credentials followed by privilege escalation or session hijacking to achieve administrative control. To mitigate this risk, organizations running Nginx Proxy Manager should immediately upgrade to version 2.16.1 or later where these rate-limiting controls have been implemented and enforced on both the primary authentication endpoint and the two-factor verification endpoint. Additionally, until an update can be applied, administrators may consider placing a reverse proxy in front of Nginx Proxy Manager that enforces strict IP-based rate limiting for API endpoints, although this is only a compensating control rather than a permanent fix. Enforcing strong password policies and ensuring all accounts utilize complex TOTP secrets can also reduce the success probability of brute-force attacks but does not address the fundamental architectural flaw in request handling limits.