Nginx UI: Authentication bypass, passkey second factor not enforced at login

Summary

Nginx UI, a web interface for the Nginx web server, does not enforce a registered passkey during password login for accounts that have a passkey but no TOTP secret. The login endpoint checks only TOTP, so such an account receives a full session after password verification alone. An attacker who obtains the password (for example through phishing, password reuse or a leak) can take over the account and reach administrative functions, including the terminal feature that grants a host shell.

Affected

• Nginx UI from 2.0.0 before 2.5.0 (CNA range)
• The vendor advisory lists versions up to 2.3.11; PT Security lists up to 2.4.9 and VulDB up to 2.4.x
• Accounts with a passkey but no TOTP are affected

Fixed in

• Version 2.5.0 (fix commit 95cd21b70814e5d9a48a359aa238aeea1ac97429)
• Version 2.5.1 is a hotfix that includes all changes of 2.5.0; later releases exist but were not verified

Workaround

• No vendor workaround documented.
• Restrict access to the admin UI to VPN or management networks until the update is installed.

Exploitation

• No evidence of exploitation in the wild found. CISA SSVC lists exploitation as PoC, automatable as no and technical impact as total.
• The advisory describes a proof-of-concept test; a public PoC should be assumed.
• Not listed in CISA KEV according to a third-party tracker (not verified directly).

Our recommendation

• Update Nginx UI to version 2.5.0 or later, ideally the latest stable release.
• Check whether the admin UI is reachable from the internet and restrict it if not required.
• Enforce strong, unique passwords and review admin logins for accounts that rely only on a passkey.
• Rotate secrets if the installation ever ran version 2.3.6 or earlier or restored a backup from such a version, as described in the 2.5.0 release notes.
• Also check CVE-2026-107807 (Node.Secret via query parameter), which affects the same versions and should be patched together.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-45gv-9wjv-xh7p github.com
• Fix commit 95cd21b70814e5d9a48a359aa238aeea1ac97429 github.com
• Nginx UI release v2.5.0 github.com
• Nginx UI release v2.5.1 github.com
• OSV GHSA-45gv-9wjv-xh7p osv.dev
• VulDB 415942 vuldb.com
• PT Security PT-2026-108957 vulners.com
• Nginx UI WebAuthn configuration guide nginxui.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:24.