Threats tagged 'ghsa-vc32-4gwf-77xp'

CVE-2026-84360 is an authentication bypass vulnerability in 0xJacky's nginx-ui product that allows OTP-enabled users to bypass the intended secure session requirement for high-impact Nginx configuration changes. The vulnerability arises because the MCP endpoints, which allow configuration mutations, require only ordinary authentication rather than the stricter secure session. This enables an attacker with valid JWT authentication but without a secure session to modify Nginx configuration via the /mcp and /mcp_message endpoints. The issue was verified with a proof-of-concept demonstrating successful configuration changes without step-up authentication.