CVE-2025-50579: Nginx Proxy Manager · Improper Restriction of Security Token Assignment
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should take the following specific actions: 1) Immediately audit and review the CORS configuration in Nginx Proxy Manager installations, ensuring that the Origin header is strictly validated against a whitelist of trusted domains. Avoid using wildcard or overly permissive CORS policies. 2) Implement Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and reduce the risk of cross-origin attacks. 3) Rotate and invalidate existing JWT tokens to limit the window of exposure for potentially compromised tokens. 4) Monitor network traffic and application logs for unusual access patterns or token exfiltration attempts, using anomaly detection tools where possible. 5) If feasible, isolate the Nginx Proxy Manager management interface behind VPNs or internal-only networks to reduce exposure to external attackers. 6) Stay updated with vendor advisories and apply patches or configuration updates as soon as they become available. 7) Educate users about the risks of visiting untrusted websites while authenticated to critical infrastructure components. These steps go beyond generic advice by focusing on configuration hardening, token lifecycle management, and network segmentation tailored to this specific vulnerability.
Description
A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. This misconfiguration enables attackers to intercept tokens using a simple browser script and exfiltrate them to a remote attacker-controlled server, potentially leading to unauthorized actions within the application.