Nginx UI: Missing re-authentication for TOTP and passkey enrollment
Summary
Nginx UI, a web interface for managing the Nginx web server, lets logged-in users register TOTP and passkey factors on their account. Before version 2.4.1, the enrollment endpoints do not require the current password or a secure session. An attacker with a stolen JWT can bind their own TOTP secret or passkey, which can survive a password change and disrupt the legitimate user's login.
Affected
- 0xJacky Nginx UI, all versions before 2.4.1
Fixed in
- Version 2.4.1 (fix commit 23d1934099b05b2a01589b48129dc3d3159d91c2)
- Vendor data notes that the route change alone may not cover accounts without OTP; confirm with the vendor advisory before relying on 2.4.1 alone
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation status 'poc', not automatable, total technical impact
- No evidence of exploitation in the wild found; not listed in CISA KEV in the sources reviewed
- No public proof-of-concept confirmed in primary sources
Our recommendation
- Upgrade to version 2.4.1 or later, and check the vendor advisory GHSA-gfrc-g87h-7h5w for the latest fixed release
- After patching, review each account for TOTP or passkey entries the user does not recognise
- Rotate the JwtSecret after patching so that stolen JWTs become invalid
- Restrict access to the admin interface to a VPN or an IP allowlist
- Monitor logs for enrollment requests from unknown sources
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 23d1934 (GitHub) github.com
- Release v2.4.1 (GitHub) github.com
- Security advisory GHSA-gfrc-g87h-7h5w (GitHub) github.com
- CVE-2026-84313 (OSV) osv.dev
- CVE-2026-84313 (OpenCVE) app.opencve.io
- Release v2.5.1 (GitHub) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:22.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.