CVE-2026-84313: CWE-287: Improper Authentication in 0xJacky nginx-ui
Description
CVE-2026-84313 is an improper authentication vulnerability in 0xJacky's nginx-ui prior to version 2.4.1. Certain API endpoints related to OTP enrollment and passkey registration do not verify the current password and are accessible with a normal authenticated session. This allows an attacker with a stolen JWT to bind attacker-controlled TOTP secrets or register passkeys, potentially maintaining persistent access even after a password change. The issue is fixed in version 2.4.1.
CVSS v3.1
Score 8.8high
Affected software
0xJacky
nginx-ui
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in nginx-ui versions before 2.4.1 involves the POST /api/otp_enroll and POST /api/finish_passkey_register endpoints, which are not protected by RequireSecureSession and do not verify the current password. An attacker possessing a stolen JWT token can exploit this to bind a malicious TOTP secret or register a passkey without the victim's knowledge, enabling persistent account access that survives password changes. This improper authentication flaw is classified under CWE-287 and CWE-306 and has a CVSS 3.1 score of 8.8 (high severity). The vendor fixed this issue in version 2.4.1.
Potential Impact
An attacker with a stolen JWT token can gain persistent unauthorized access to user accounts by binding attacker-controlled TOTP secrets or registering passkeys without password verification. This access can persist even after the legitimate user changes their password, compromising confidentiality, integrity, and availability of the affected accounts.
Mitigation Recommendations
Upgrade nginx-ui to version 2.4.1 or later, where this improper authentication issue is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating the fix in 2.4.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:17:43.079Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd4b482cdf04f656d3ef75
Added to database: 10/12/2026, 21:04:08 UTC
Last enriched: 10/12/2026, 21:18:53 UTC
Last updated: 10/12/2026, 21:19:03 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.