CVE-2025-50579: Nginx Proxy Manager CORS Vulnerability

CVE-2025-50579 Overview

CVE-2025-50579 is a Cross-Origin Resource Sharing (CORS) misconfiguration affecting Nginx Proxy Manager version 2.12.3. The application fails to properly validate the Origin header on cross-origin requests. Unauthorized domains can read sensitive response data, including JSON Web Tokens (JWTs) issued to authenticated users. An attacker who lures a logged-in user to a malicious page can execute a browser script that reads the token and exfiltrates it to an attacker-controlled server. Stolen tokens permit unauthorized actions inside the Nginx Proxy Manager administrative interface. The issue is tracked publicly under GitHub Issue #4509 and is classified under [CWE-1259] Improper Restriction of Security Token Assignment.

Critical Impact
Authenticated JWTs can be stolen by any attacker-controlled origin, enabling session takeover of Nginx Proxy Manager administrative accounts.

Affected Products

jc21 Nginx Proxy Manager 2.12.3
Deployments using the default CORS configuration shipped with 2.12.3
Container images (jc21/nginx-proxy-manager:2.12.3) pulled from Docker Hub

Discovery Timeline

2025-08-19 - CVE-2025-50579 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50579

Vulnerability Analysis

Nginx Proxy Manager exposes an administrative API that issues JWTs on successful authentication. The API returns permissive CORS response headers without validating the incoming Origin header against an allow list. When a browser sends a cross-origin request with credentials, the server reflects or accepts arbitrary origins and returns Access-Control-Allow-Credentials: true. Any external site can therefore read authenticated JSON responses containing tokens.

The vulnerability affects confidentiality but does not directly compromise integrity or availability of the host, consistent with the scoring in the enriched data. Exploitation requires an authenticated victim to visit an attacker-controlled page while a session cookie or token is active in the browser.

Root Cause

The root cause is improper enforcement of same-origin policy on API endpoints that return security tokens [CWE-1259]. The CORS policy shipped in Nginx Proxy Manager 2.12.3 does not restrict which origins may issue credentialed requests to token-returning endpoints. Developers likely enabled broad CORS to support flexible reverse-proxy setups, but the setting extends to sensitive authentication routes.

Attack Vector

The attack is network-based and requires no privileges on the target server. The attacker hosts a page containing JavaScript that issues an XMLHttpRequest or fetch call to the victim's Nginx Proxy Manager instance with credentials: 'include'. Because the server responds with permissive CORS headers, the attacker's script reads the JWT from the response body or Authorization-related payload and posts it to a remote collector. The attacker then replays the JWT against the same Nginx Proxy Manager instance to perform administrative actions.

No verified proof-of-concept code is published in the enriched references. See GitHub Issue #4509 for the maintainer discussion of the flaw.

Detection Methods for CVE-2025-50579

Indicators of Compromise

Access logs showing successful cross-origin POST or GET requests to /api/tokens or /api/users/* from Origin headers not belonging to the administrator's browser origin.
Repeated administrative API calls (proxy host creation, certificate issuance) from IP addresses that did not perform an interactive login.
Outbound browser requests from administrator workstations to unknown domains immediately after loading the Nginx Proxy Manager UI.

Detection Strategies

Inspect HTTP response headers on /api/* routes for Access-Control-Allow-Origin values that reflect the request Origin alongside Access-Control-Allow-Credentials: true.
Correlate JWT issuance events with subsequent API calls originating from different source IPs, which suggests token replay.
Deploy web application firewall rules that flag credentialed cross-origin requests targeting authentication endpoints.

Monitoring Recommendations

Forward Nginx Proxy Manager access logs to a centralized logging platform and alert on unexpected Origin and Referer values on token endpoints.
Monitor administrator endpoint telemetry for browser processes making unusual outbound HTTP requests after visiting the management console.
Track newly created proxy hosts, redirection hosts, and SSL certificates for changes that do not align with a change-management ticket.

How to Mitigate CVE-2025-50579

Immediate Actions Required

Restrict access to the Nginx Proxy Manager administrative interface to trusted management networks or VPN clients until a patched release is deployed.
Rotate all existing JWT signing secrets and force re-authentication of every administrative account.
Audit the proxy host, redirection host, and certificate configuration for unauthorized changes.

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed version is listed in the enriched data. Track the upstream project at Nginx Proxy Manager on GitHub and the tracking ticket GitHub Issue #4509 for a release that enforces an origin allow list on authentication endpoints.

Workarounds

Place Nginx Proxy Manager behind an upstream reverse proxy that strips or overrides Access-Control-Allow-Origin and Access-Control-Allow-Credentials response headers for /api/* paths.
Add a strict Content-Security-Policy and SameSite=Strict cookie attribute at the upstream proxy to reduce cross-origin token exposure.
Require administrators to access the console from a dedicated browser profile that is not used for general web browsing.

bash

# Example upstream Nginx snippet to override CORS on the admin API
location /api/ {
    proxy_pass http://npm_backend;
    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Access-Control-Allow-Credentials;
    add_header Access-Control-Allow-Origin "https://npm.internal.example.com" always;
    add_header Access-Control-Allow-Credentials "true" always;
    add_header Vary "Origin" always;
}