CVE-2026-107808
highNginx UI is a web user interface for the Nginx web server.
Vendor / product: Nginxui — nginx ui
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
CVSS
8.1
8.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-09 16:17
Modified: 2026-10-20 15:24
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
nginxui / nginx_ui ≥2.0.0 <2.5.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
Patch / mitigation: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
Patch / mitigation: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
References
- https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429 security-advisories@github.com
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 security-advisories@github.com
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p security-advisories@github.com
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗