CVE-2026-84313: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Q: What access does an attacker need to exploit this issue?

An attacker needs a stolen valid JWT for an authenticated Nginx UI account. They do not need the account's current password or additional user interaction.

Q: Which accounts are susceptible to each enrollment path?

TOTP enrollment can be abused when the victim has not already enabled TOTP. Passkey registration has no equivalent existing-enrollment guard, allowing an attacker-controlled passkey to be registered through that path.

Q: Does changing the user's password remove the attacker's access?

Not necessarily. An attacker-added TOTP secret or passkey can provide persistent access that survives a password change and can disrupt the legitimate user's authentication.

Q: Which versions are affected and what version fixes the issue?

Nginx UI versions prior to 2.4.1 are affected. The issue is fixed in version 2.4.1.

Published Oct 12, 2026

Updated

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.

Affected Software

1 affected component

0xJacky Nginx UI<2.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nginx UI to a version that resolves this vulnerability.
Fixed in 2.4.1

Event History

Oct 12, 2026

CVE Published

via MITRE·08:51 PM

Data Sourced

via MITRE·08:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs a stolen valid JWT for an authenticated Nginx UI account. They do not need the account's current password or additional user interaction.

Which accounts are susceptible to each enrollment path?

TOTP enrollment can be abused when the victim has not already enabled TOTP. Passkey registration has no equivalent existing-enrollment guard, allowing an attacker-controlled passkey to be registered through that path.

Does changing the user's password remove the attacker's access?

Not necessarily. An attacker-added TOTP secret or passkey can provide persistent access that survives a password change and can disrupt the legitimate user's authentication.

Which versions are affected and what version fixes the issue?

Nginx UI versions prior to 2.4.1 are affected. The issue is fixed in version 2.4.1.

CVE-2026-84313: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which accounts are susceptible to each enrollment path?

Does changing the user's password remove the attacker's access?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which accounts are susceptible to each enrollment path?

Does changing the user's password remove the attacker's access?

Which versions are affected and what version fixes the issue?