CVE-2026-107808
An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.41% probability · 35th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-305, CWE-308
- Affected
- nginxui/nginx ui
- Source
- security-advisories@github.com
EPSS moved from 0.4% on 10 October 2026 to 0.4% on 26 October 2026.
References
- https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429Patch
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0Release Notes
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7pExploit, Vendor Advisory, Mitigation
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7pExploit, Vendor Advisory, Mitigation
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.