Nexus Repository 3 version 3.17.0 contains an endpoint used to change the administrator account password during initial onboarding. The endpoint fails to verify that onboarding is still active before allowing the password change, relying only on the presence of a local onboarding artifact. Consequently, an account with nexus:* permission can invoke this endpoint outside the intended onboarding process to replace the administrator password. Additionally, existing sessions are not invalidated after the password change, potentially allowing continued access with old sessions.

An attacker or user with nexus:* permission can change the administrator password outside the intended onboarding phase, potentially gaining or maintaining unauthorized administrative access. Since existing sessions are not invalidated, previously authenticated sessions remain active, increasing the risk of unauthorized control over the repository.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict nexus:* permissions to trusted users only and monitor for unusual password change activity related to onboarding endpoints.