An unauthenticated bootstrap takeover vulnerability exists in nginx-ui version 2.3.5 during the initial installation window via the POST /api/install endpoint. This endpoint is accessible without authentication when the instance is uninitialized, allowing an attacker to submit bootstrap data that sets the application's JWT secret, node secret, certificate email, and initial administrator credentials. The vulnerability allows an attacker with network access to a fresh instance within the initial setup window (approximately 10 minutes) to claim administrative control before the legitimate operator. This issue is limited to the initial setup phase and does not affect post-install instances.