Disclosure summary
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
Source-reported weakness categories
CWE-287, CWE-305, CWE-308
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-107808
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-45gv-9wjv-xh7p
Open original source · Updated Oct 09, 2026
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Source severity: HIGH / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| go | github.com/0xJacky/Nginx-UI | >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814 | 1.9.10-0.20260728074558-95cd21b70814 |
Original records & references
PUBLISHED 2026-10-09T12:17:25-04:00
MODIFIED 2026-10-09T14:17:02-04:00
INGESTED 2026-10-10T20:55:12-04:00