CVE-2026-84313 in Nginx UI
Summary
by MITRE • 10/13/2026
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The Nginx UI application, serving as a web-based management interface for the Nginx reverse proxy server, contains critical authentication bypass vulnerabilities that compromise account integrity through improper session validation during security feature enrollment. Specifically, endpoints designed to enroll Time-Based One-Time Password (TOTP) secrets and register FIDO2 passkeys fail to enforce strict session requirements necessary for such sensitive operations. In versions prior to 2.4.1, the POST /api/otp_enroll and POST /api/finish_passkey_register routes are registered outside the RequireSecureSession middleware or lack equivalent validation logic that checks the current password against the provided credentials before proceeding with enrollment. This architectural flaw allows an attacker who has obtained a valid JSON Web Token (JWT) to bypass multi-factor authentication setup requirements by simply presenting the token without proving knowledge of the user's current login password.
The operational impact of this vulnerability is severe, as it enables persistent unauthorized access that survives standard credential rotation procedures. If a victim has not yet enabled two-factor authentication, an attacker with a stolen JWT can bind their own TOTP secret to the account. Similarly, because the passkey registration path lacks any guard against existing enrollments or password verification, an attacker can register a malicious FIDO2 authenticator linked to the victim's identity. Once these credentials are established, they serve as persistent backdoors that remain valid even if the legitimate user changes their primary password, effectively locking out the owner and granting the attacker indefinite control over the Nginx UI interface. This persistence mechanism undermines the fundamental security assumption that changing a password revokes all other forms of authentication or session tokens not explicitly invalidated by such an action.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify identity during critical state changes. It also relates to CWE-613 Insufficient Session Expiration, given that stolen JWTs can be exploited for prolonged access if not properly scoped or validated against current session security policies. In terms of attack vectors, this maps to MITRE ATT&CK technique T1078 Valid Accounts and specifically the sub-technique of using compromised credentials to establish persistence through MFA bypass. The flaw represents a classic case where convenience features like web-based UI management are implemented without adhering to strict security principles regarding privilege escalation and credential binding, allowing lateral movement or full account takeover when session tokens are intercepted via network sniffing, XSS, or other token theft methods.
Mitigation for this vulnerability requires an immediate upgrade to Nginx UI version 2.4.1 or later, where the RequireSecureSession middleware is correctly applied to these endpoints and password verification logic is enforced before allowing TOTP or passkey enrollment. Organizations should also audit their JWT implementation strategies to ensure that tokens are short-lived and scoped appropriately to minimize the window of opportunity for exploitation if a token is compromised. Additionally, implementing strict session management policies that invalidate all active sessions upon significant security changes, such as enabling MFA or changing passwords, can provide an additional layer of defense against persistent access attempts derived from stolen credentials.