CVE-2026-102334: Nginx Proxy Manager Auth Bypass Vulnerability

CVE-2026-102334 Overview

CVE-2026-102334 affects Nginx Proxy Manager through version 2.16.0. The application fails to enforce rate-limiting on authentication endpoints, allowing unauthenticated attackers to perform unlimited password guesses against any account. Attackers can brute-force credentials via POST /api/tokens and then guess Time-based One-Time Password (TOTP) codes via POST /api/tokens/2fa to obtain full session access and administrative control. The weakness is categorized as [CWE-307] Improper Restriction of Excessive Authentication Attempts.

Critical Impact

Unauthenticated attackers can brute-force administrator credentials and bypass two-factor authentication to gain full administrative control of the proxy manager.

Affected Products

• Nginx Proxy Manager versions through 2.16.0
• The /api/tokens authentication endpoint
• The /api/tokens/2fa two-factor authentication endpoint

Discovery Timeline

• 2026-09-28 - CVE-2026-102334 published to the National Vulnerability Database (NVD)
• 2026-09-29 - Last updated in the NVD database

Technical Details for CVE-2026-102334

Vulnerability Analysis

Nginx Proxy Manager exposes two authentication endpoints without any request throttling or account lockout logic. The primary login endpoint POST /api/tokens accepts username and password credentials and returns a session token when the credentials are valid. The follow-on endpoint POST /api/tokens/2fa accepts a six-digit TOTP code to complete multi-factor authentication.

Because neither endpoint tracks failed attempts or delays repeated requests, an attacker can issue thousands of credential guesses per minute from a single source. Once valid credentials are found, the attacker can iterate the entire six-digit TOTP keyspace against POST /api/tokens/2fa in a short window. Successful exploitation yields a valid session token with administrator privileges, exposing proxy configurations, SSL certificates, and access-list definitions.

Relevant code paths are visible in the upstream repository at backend/app.js, backend/internal/token.js, and backend/internal/2fa.js for version 2.16.0.

Root Cause

The root cause is the absence of authentication attempt tracking. The token issuance logic in token.js and the 2FA verification logic in 2fa.js do not increment a failure counter, apply exponential backoff, or lock accounts after repeated failures. The Express application defined in app.js also lacks middleware that enforces per-IP or per-account rate limiting on these routes.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker sends automated POST requests to /api/tokens with candidate credentials. After a valid credential pair is discovered, the attacker sends automated POST requests to /api/tokens/2fa cycling through six-digit codes until the session is upgraded. The full workflow can be scripted with standard HTTP tooling and executed against any internet-exposed Nginx Proxy Manager instance.

Refer to the VulnCheck Advisory on Nginx Proxy Manager for additional technical detail.

Detection Methods for CVE-2026-102334

Indicators of Compromise

• High volumes of POST requests to /api/tokens from a single source IP within a short time window.
• Sequential POST requests to /api/tokens/2fa following a successful /api/tokens response.
• Successful administrator logins from unfamiliar IP addresses or geolocations.
• Unexpected changes to proxy hosts, redirection rules, or SSL certificates in the management UI.

Detection Strategies

• Parse access logs for repeated 401 responses on /api/tokens followed by a 200 response from the same client.
• Alert when the rate of authentication requests to Nginx Proxy Manager exceeds a defined baseline.
• Correlate /api/tokens and /api/tokens/2fa request pairs to identify sequential brute-force patterns.

Monitoring Recommendations

• Forward Nginx Proxy Manager access and application logs to a centralized logging platform for retention and analysis.
• Monitor administrative configuration changes and audit trails for actions performed by newly authenticated sessions.
• Track outbound network activity from the Nginx Proxy Manager host to detect follow-on activity after account takeover.

How to Mitigate CVE-2026-102334

Immediate Actions Required

• Restrict network exposure of the Nginx Proxy Manager administrative interface to trusted management networks or VPN only.
• Place a reverse proxy or web application firewall in front of /api/tokens and /api/tokens/2fa to enforce rate limits.
• Rotate administrator passwords and reset TOTP seeds if exposure is suspected.
• Review recent authentication logs for evidence of brute-force activity.

Patch Information

Refer to the upstream project for the current release status and fix availability. Related work is tracked in GitHub Pull Request #5908 in the Nginx Proxy Manager repository. Upgrade to a version that introduces rate limiting and account lockout on the authentication endpoints once available.

Workarounds

• Deploy a rate-limiting reverse proxy such as an upstream Nginx instance with limit_req_zone targeting /api/tokens and /api/tokens/2fa.
• Use network access control lists to restrict administrative access to specific source IP ranges.
• Enable IP-based blocking tools such as fail2ban with a filter that matches repeated 401 responses on the token endpoints.

# Example Nginx rate-limit configuration for the token endpoints
http {
    limit_req_zone $binary_remote_addr zone=npm_auth:10m rate=5r/m;

    server {
        listen 443 ssl;
        server_name npm.example.com;

        location /api/tokens {
            limit_req zone=npm_auth burst=5 nodelay;
            proxy_pass http://127.0.0.1:81;
        }

        location /api/tokens/2fa {
            limit_req zone=npm_auth burst=5 nodelay;
            proxy_pass http://127.0.0.1:81;
        }
    }
}