Patch Forecast
Amber warning
Patch this week.

CVE-2026-84313 · GHSA-gfrc-g87h-7h5w

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Risk score
75/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.4%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controll…
Affected
Nginx-UI (go) < 1.9.10-0.20260703131214-23d1934099b0
Fix
Upgrade Nginx-UI to 1.9.10-0.20260703131214-23d1934099b0 or later.
Exploitation
Public proof of concept

Story map

Story map: Nginx-UITHE FLAWSTHE FIXCVE-2026-84313Nginx UI: TOTP / passkeyenrolment requires nore-authentication, enabling…CVSS 8.8 · EPSS 0%CVE-2026-84312Nginx UI: Casdoor SSO callbackuses a constant `state`parameter (login CSRF)CVSS 7.1 · EPSS 0%Upgrade Nginx-UI2.4.1or later on your release lineWho is exposedNginx-UI (go) <1.9.10-0.20260703131214-23d1934099b0AMBER · PATCH THIS WEEKNginx-UINginx UI is a web user interfacefor the Nginx web server. Priorto 2.4.1, POST /api/otp_enrolland POST/api/finish_passkey_registerare registered outsideRequireSecureSession and…Where it standsPublic proof of conceptCONNECTS TOSame weaknessAuthentication bypass (CWE-287)236 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Nginx-UI: Amber, patch this week. Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controll…

The flaws

  • CVE-2026-84313: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover (CVSS 8.8 · EPSS 0%)
  • CVE-2026-84312: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Nginx-UI: 2.4.1 or later on your release line

Who is exposed: Nginx-UI (go) < 1.9.10-0.20260703131214-23d1934099b0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.8 high
  • Public exploit or proof of concept referenced
  • On your watchlist: nginx, Go

Affected packages

PackageEcosystemVulnerableFixed in
Nginx-UIgo< 1.9.10-0.20260703131214-23d1934099b01.9.10-0.20260703131214-23d1934099b0

References

Original description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.

Last activity 12 Oct 2026. Patch Forecast updates every hour.