CVE-2026-107804: CWE-346: Origin Validation Error in 0xJacky nginx-ui

The vulnerability in nginx-ui versions >=2.2.0 and <2.6.0 arises because the bundled reverse proxy fails to preserve the external client IP identity, attributing requests to the loopback address. This misattribution allows management requests with valid credentials to bypass IP allowlist restrictions that exempt the loopback address. Additionally, failed login attempts from different external clients are all attributed to the same loopback address, enabling an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without affecting existing sessions. The flaw is classified as CWE-346 (Origin Validation Error) and has a CVSS 3.1 base score of 5.3 (medium severity). The issue is resolved in version 2.6.0.

An attacker can exploit this vulnerability to bypass IP allowlist restrictions for management requests if valid credentials are provided, due to the proxy attributing requests to the loopback address. Furthermore, unauthenticated attackers can cause denial-of-service conditions by triggering shared temporary login bans across multiple clients without invalidating active sessions. There is no direct confidentiality or integrity impact reported. No known exploits are in the wild.

Upgrade nginx-ui to version 2.6.0 or later, where this issue is fixed. Until then, be aware that the bundled reverse proxy does not preserve client IP identity, which may allow bypass of IP allowlist protections and enable denial-of-service via shared login bans. No other vendor advisories or patches are provided; therefore, patching to 2.6.0 is the recommended remediation.