An unauthenticated attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window via the public /api/install endpoint. This allows permanent takeover of the initial admin account if the attacker acts before the legitimate operator. The vulnerability exists because the installation endpoint does not require authentication and only enforces a 10-minute window after startup. The attacker can set admin credentials, overwriting user ID 1, which always exists. This impacts nginx-ui versions from 2.0.0 up to but not including 2.3.8.