{"id":"EUVD-2026-97865","enisaUuid":"9aa5c18b-fd33-3826-a793-a10061da4a08","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user\u0027s authentication. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:51:44 PM","dateUpdated":"Oct 15, 2026, 1:48:40 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84313\nGHSA-gfrc-g87h-7h5w\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"45ea5ac9-5ac7-3301-a6ae-797dd46e9ec5","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"enisaIdVendor":[{"id":"1a31138b-9942-35fd-80c5-fba4d2f7e302","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"43189c36-4e7d-36c5-876a-c4c66d52289d","vulnerability":{"id":"CVE-2026-84313","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user\u0027s authentication. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:51:44 PM","dateUpdated":"Oct 15, 2026, 1:48:40 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97865\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Oct 30, 2026, 7:13:27 AM","vulnerabilityProduct":[{"id":"6fbdd456-4335-3c52-afdb-d5f5f007e2f5","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"92ba7ee9-7daa-37c6-8a60-ce5a8370ea16","vendor":{"name":"0xJacky"}}]}},{"id":"77902019-21a8-3dd3-97cd-ef070b791fec","vulnerability":{"id":"GHSA-gfrc-g87h-7h5w","description":"Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover","datePublished":"Oct 15, 2026, 8:11:32 PM","dateUpdated":"Oct 28, 2026, 3:04:55 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84313\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97865\n","aliases":"GHSA-gfrc-g87h-7h5w\nCVE-2026-84313\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 1:01:07 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}