GHSA-45GV-9WJV-XH7P Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

CVE-2026-107808

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-107808

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-107808 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-107808 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-107808 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-107808

The Nginx UI web user interface (versions 2.0.0 to 2.5.0 ) is vulnerable to an authentication bypass due to improper 2FA enforcement. Specifically, the POST /api/login endpoint fails to require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured, even if EnabledOTP i...

EUVD-2026-95891

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-107808: Improper Authentication

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

PT-2026-108957

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description An authentication bypass exists where the POST /api/login endpoint checks EnabledOTP but fails to require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. This...