Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102334 · Microsoft / collected KEV context

cve-program · CVE-2026-102334

• https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908
• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/app.js#L15-L58
• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/token.js#L154-L182
• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/2fa.js#L196-L240
• https://github.com/NginxProxyManager/nginx-proxy-manager
• https://www.vulncheck.com/advisories/nginx-proxy-manager-through-2.16.0-missing-brute-force-protection

No related operational record is retained in the current change model.