CVE-2026-84313: Nginx UI Authentication Bypass Vulnerability

CVE-2026-84313 Overview

Nginx UI, a web user interface for the Nginx web server, contains an authentication weakness in versions prior to 2.4.1. The POST /api/otp_enroll and POST /api/finish_passkey_register endpoints are registered outside the RequireSecureSession middleware. These endpoints accept a normal authenticated session without re-verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled Time-based One-Time Password (TOTP) secret when the victim has not already enrolled, or register an attacker-controlled passkey. The flaw is tracked as [CWE-287: Improper Authentication].

Critical Impact
Attackers holding a stolen session token can establish persistent account access that survives password resets and interferes with legitimate user authentication.

Affected Products

Nginx UI versions prior to 2.4.1
POST /api/otp_enroll endpoint
POST /api/finish_passkey_register endpoint

Discovery Timeline

2026-10-12 - CVE-2026-84313 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-84313

Vulnerability Analysis

The vulnerability lies in the router registration for second-factor enrollment endpoints. In vulnerable builds, /api/otp_enroll and /api/finish_passkey_register are protected only by AuthRequired, which validates the JWT session. They do not pass through RequireSecureSession, the middleware that requires the user to re-confirm their current password before performing sensitive account changes.

An attacker who obtains a valid JWT, through token theft, cross-site scripting, or session fixation, can call these endpoints directly. If the victim has not already enrolled TOTP, the attacker binds a secret they control. The passkey registration path lacks any equivalent existing-enrollment guard, so an attacker can register an attacker-controlled WebAuthn credential even against a victim who already uses passkeys.

Root Cause

The root cause is a missing authorization check on state-changing authentication endpoints. The code paths require session authentication but not re-authentication, violating the principle that sensitive security operations should require fresh credential proof.

Attack Vector

Exploitation requires a valid authenticated session token for the target account. The attacker sends a crafted POST request to the vulnerable enrollment endpoint with their own TOTP secret or passkey material. The resulting enrollment persists across password changes, giving the attacker a durable foothold even after the victim rotates credentials.

// Patch excerpt from api/backup/router.go illustrating the fix pattern
func InitRouter(r *gin.RouterGroup) {
-    r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+    r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
     r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)
}

Source: GitHub Commit 23d1934

The commit adds middleware.RequireSecureSession() to sensitive routes and groups related endpoints under a shared middleware chain, as shown in api/certificate/router.go:

-    r.POST("dns_credentials", AddDnsCredential)
-    r.POST("dns_credentials/:id", EditDnsCredential)
-    r.DELETE("dns_credentials/:id", DeleteDnsCredential)
+    o := r.Group("", middleware.RequireSecureSession())
+    {
+        o.POST("dns_credentials", AddDnsCredential)
+        o.POST("dns_credentials/:id", EditDnsCredential)
+        o.DELETE("dns_credentials/:id", DeleteDnsCredential)
+    }

Source: GitHub Commit 23d1934

Detection Methods for CVE-2026-84313

Indicators of Compromise

Unexpected POST /api/otp_enroll requests in Nginx UI access logs, especially from IPs that differ from the account owner's usual geolocation.
Unexpected POST /api/finish_passkey_register requests, particularly for accounts that already have an active passkey enrolled.
New TOTP or passkey enrollment events in Nginx UI audit records without a corresponding password re-verification event.

Detection Strategies

Alert on any successful call to /api/otp_enroll or /api/finish_passkey_register where the preceding session did not include a recent password confirmation.
Correlate enrollment events with the originating session's authentication timestamp and source IP to detect anomalies.
Flag accounts where multiple second-factor credentials are registered within a short time window.

Monitoring Recommendations

Forward Nginx UI application and reverse-proxy logs to a central analytics platform for retention and correlation.
Monitor for JWT reuse across disparate IP addresses or user agents, which may indicate token theft.
Track administrative account changes and alert security teams on any out-of-band second-factor modification.

How to Mitigate CVE-2026-84313

Immediate Actions Required

Upgrade all Nginx UI deployments to version 2.4.1 or later without delay.
Audit existing TOTP and passkey enrollments for every account and remove unexpected entries.
Invalidate all active JWT sessions after upgrading and require users to re-authenticate.

Patch Information

The issue is fixed in Nginx UI version 2.4.1. The maintainers added the RequireSecureSession middleware to sensitive endpoints, forcing a current-password re-verification before TOTP enrollment, passkey registration, backup, certificate, and DNS credential operations. Review the GitHub Release v2.4.1 and the GitHub Security Advisory GHSA-gfrc-g87h-7h5w for complete details.

Workarounds

Restrict network access to the Nginx UI management interface using firewall rules or a VPN while the upgrade is scheduled.
Shorten JWT lifetimes and enforce aggressive session timeouts to limit the window for stolen token abuse.
Enforce TOTP or passkey enrollment for all accounts proactively so the pre-enrollment attack path is closed.

bash

# Verify installed Nginx UI version and upgrade if below 2.4.1
nginx-ui -version
# Pull the fixed release
docker pull uozi/nginx-ui:2.4.1