Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107808 · Microsoft / collected KEV context

EUVD-2026-95891

GHSA-45gv-9wjv-xh7p

GO-2026-6704

cve-program · CVE-2026-107808

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
• https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

euvd · EUVD-2026-95891

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
• https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

nvd · CVE-2026-107808

• https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p

osv · GHSA-45gv-9wjv-xh7p

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
• https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
• https://github.com/0xJacky/nginx-ui
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

osv · GO-2026-6704

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
• https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

No related operational record is retained in the current change model.