Multiple security vulnerabilities have been identified in nginx-ui, a web-based management interface for Nginx, affecting versions before 1.9.10-0.20260703131214-23d1934099b0. The issues involve authentication and single sign-on logic and can allow account takeover or forced authentication as another user. Overall risk is high because an attacker with limited access or a victim interaction can gain persistent control or access sensitive configuration in deployments that expose the interface.
CVE-2026-84313 (CVSS 8.8 — High): The two-factor enrollment component allows a TOTP secret or passkey to be bound to the current user using only a valid session token, without requiring the user's current password. An attacker who obtains such a token can attach their own second factor to the victim account, enabling persistent account takeover that survives password changes.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in nginx-ui, a web-based management interface for Nginx, affecting versions before 1.9.10-0.20260703131214-23d1934099b0. The issues involve authentication and single sign-on logic and can allow account takeover or forced authentication as another user. Overall risk is high because an attacker with limited access or a victim interaction can gain persistent control or access sensitive configuration in deployments that expose the interface.
CVE-2026-84313 (CVSS 8.8 — High): The two-factor enrollment component allows a TOTP secret or passkey to be bound to the current user using only a valid session token, without requiring the user's current password. An attacker who obtains such a token can attach their own second factor to the victim account, enabling persistent account takeover that survives password changes.[emaillocker id="1283"]
CVE-2026-84312 (CVSS 7.1 — High): The single sign-on callback uses a constant state value and does not validate it against a per-session value, allowing a login cross-site request forgery attack. An attacker can force a victim's browser to complete an authentication flow with the attacker's identity, causing the victim to be authenticated as the attacker and potentially expose configuration or data.
These vulnerabilities collectively present a high risk of persistent account takeover and forced authentication for deployments that expose the management interface. Users whose session tokens can be stolen and operators who rely on single sign-on are most at risk. The issues should be treated as high-priority security concerns.
The following reports contain further technical details:
[/emaillocker]