CVE-2026-102334: Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
Affected Software
Event History
Frequently Asked Questions
Who can attempt to exploit this issue?
Any unauthenticated attacker who can reach the Nginx Proxy Manager authentication API can submit unlimited password guesses against accounts. No existing account privileges or user interaction are required.
Does two-factor authentication prevent exploitation?
No. After guessing valid credentials, an attacker can also submit unlimited TOTP guesses to the two-factor authentication endpoint, potentially obtaining a full session and administrative control.
Which endpoints should be monitored for exploitation attempts?
Monitor POST requests to /api/tokens for repeated authentication attempts and POST requests to /api/tokens/2fa for repeated TOTP submissions. High-volume or sustained requests to either endpoint may indicate brute-force activity.
What can be done while a fix is unavailable?
Restrict network access to the authentication API to trusted users or networks where possible, and apply rate limiting in a compensating control in front of the affected service. Monitor for repeated login and TOTP failures.