CVE-2026-107808: CWE-287: Improper Authentication in 0xJacky nginx-ui
Description
CVE-2026-107808 is an improper authentication vulnerability in 0xJacky's nginx-ui web interface versions 2.0.0 through 2.4.x. The flaw allows bypassing two-factor authentication (2FA) when a passkey-only account is configured without a TOTP secret. An attacker who knows the password can gain administrative access without providing the registered passkey. This issue is resolved in version 2.5.0.
CVSS v3.1
Score 8.1high
Affected software
0xJacky
nginx-ui
pkg:github/0xjacky/nginx-uiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Nginx UI versions from 2.0.0 until 2.5.0 contain an authentication bypass vulnerability in the POST /api/login endpoint. When EnabledPasskey is true but no TOTP secret is configured, the system does not require a WebAuthn assertion despite Enabled2FA indicating 2FA is enabled. Consequently, after password verification, a passkey-only account is granted a session without the second factor, allowing an attacker with the password to access administrative functions. The vulnerability is fixed in version 2.5.0.
Potential Impact
An attacker who obtains a valid password for a passkey-only account can bypass the second factor authentication and gain administrative access to the nginx-ui interface. This compromises confidentiality, integrity, and availability of the affected system's administrative functions.
Mitigation Recommendations
Upgrade nginx-ui to version 2.5.0 or later, where this authentication bypass vulnerability is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-08T21:23:59.820Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac9096e2cdf04f65664ff04
Added to database: 10/09/2026, 15:34:06 UTC
Last enriched: 10/09/2026, 15:48:24 UTC
Last updated: 10/09/2026, 15:49:08 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.