CVE-2026-84315
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Published Oct 12, 2026 · updated Oct 15, 2026 · 0xJacky nginx-ui
Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. rejects an OTP-enabled user's request unless the request includes a valid issued after a fresh OTP/passkey verification. The project already applies this step-up middleware to sensitive operations such as: - Nginx config create/edit/rename/delete; - site save/delete/enable/disable/rename/duplicate; - stream save/delete/enable/disable/rename/duplicate; - settings save and protected secret reads; - backup restore. However, several similarly sensitive authenticated mutation routes remain outside . An attacker who obtains an authenticated JWT/session for a 2FA-enabled user, but does not have the victim's fresh OTP/passkey secure-session token, can still perform those operations. The affected route groups include: - automatic backup create/modify/delete/restore/test-S3 operations; - DNS credential create/edit/delete operations; - certificate and ACME user create/modify/delete/register operations; - DNS domain, record, and DDNS create/update/delete operations; - Nginx reload/restart, stub-status toggle, performance-setting update, and module-cache refresh operations; - site/stream advanced-mode toggles and batch updates; - auto-certificate binding/unbinding for sites; - site navigation order and health-check updates. This report is distinct from my earlier Nginx UI report about auto-backup path traversal. This report is about missing 2FA step-up authorization on sensitive authenticated mutation routes. ## Why this is a security boundary only requires a secure-session token for users with OTP enabled. For OTP
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OT
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260703131214-23d1934099b0
Oct 15, 2026 · GitHub Advisory Database
Updated
Reporter: Jagadesh Achanta Target: Affected version / commit tested: - App version: - Commit: - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: ## AI assistance disclosure This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting. ## Summary Nginx UI has a short-lived OT
Affected
- Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260703131214-23d1934099b0
- golang github.comversion unspecified
- vendor 0xJacky nginx-uiversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-84315
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen auth
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-5v7c-xpfp-p65m
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-84315
Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. RequireSecureSession() rejects an OTP-enabled user's request unless the request includes a valid X-Secure-Session-ID issued after a fresh OTP/passkey verification. The project already applies this step-up middleware to sensitive operations such as: Nginx config create/edit/rename/delete; site save/
advisories.gitlab.com - OSV.devPackage advisoryGHSA-5v7c-xpfp-p65m
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
osv.dev