Nginx UI is a web user interface for the Nginx web server.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- F5
- Product
- NGINX
- CVSS
- 8.1
- EPSS
- 0.004 (p35)
- Fix
- available
- Exposure class
- Web platform
Why it ranks 20 (Routine)
- CVSS 8.1 high
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-107808 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.