CVE-2026-107808 in Nginx UI
Summary
by MITRE • 10/09/2026
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within Nginx UI versions ranging from 2.0.0 to 2.5.0 represents a critical authentication bypass flaw rooted in flawed logic governing multi-factor authentication enforcement. Specifically, the defect resides in the handling of the POST /api/login endpoint where the system fails to correctly validate the presence and usage of hardware-based security keys when configured for passkey-only access. The core technical issue arises because the application checks whether two-factor authentication is enabled via an EnabledOTP flag but neglects to verify that a WebAuthn assertion has been successfully presented or validated when the account configuration specifies EnabledPasskey as true, particularly in scenarios where no Time-based One-Time Password secret is configured for the user. This logical gap allows the server to issue a valid session token immediately after verifying only the static password credential, effectively treating the authentication process as complete despite the absence of the required second factor.
From an operational perspective, this flaw severely undermines the security posture provided by WebAuthn and passkey implementations. Passkeys are designed to provide phishing-resistant authentication by leveraging public-key cryptography stored on a hardware device or platform authenticator. By allowing session creation based solely on password verification when Enabled2FA reports that a second factor is present but not enforced due to this code path, the system creates an illusion of security while leaving accounts vulnerable to credential stuffing and brute-force attacks if passwords are compromised. An attacker who obtains a user's password through phishing, database leaks, or other means can bypass the intended multi-factor barrier entirely. This is particularly dangerous for administrative functionality within Nginx UI, as gaining access with these elevated privileges allows an adversary to modify server configurations, potentially leading to service disruption, data exfiltration, or further lateral movement into the underlying infrastructure managed by Nginx.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically falling under scenarios where authentication logic fails to enforce multi-factor requirements correctly. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it allows an attacker to use legitimate credentials to gain unauthorized access by bypassing the intended security controls. The flaw highlights a common pitfall in web application development where boolean flags indicating feature enablement are checked without verifying that the corresponding cryptographic proof or user interaction required for that specific mode of authentication has actually occurred. This discrepancy between configuration intent and runtime enforcement creates a significant attack surface that exploits the trust placed in multi-factor authentication systems.
To mitigate this risk, organizations running Nginx UI must upgrade to version 2.5.0 or later where the logic governing passkey verification has been corrected to ensure that WebAuthn assertions are mandatory when enabled for an account type lacking TOTP secrets. In addition to upgrading, administrators should review their authentication configurations to ensure consistency between EnabledPasskey and other two-factor settings. It is also advisable to implement defense-in-depth strategies such as IP whitelisting for administrative interfaces where possible, monitoring login attempts for anomalies indicative of credential stuffing attacks, and ensuring that all services relying on Nginx UI are kept up-to-date with the latest security patches to prevent exploitation of known logical flaws in authentication workflows.