CVE-2026-107808: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Vulnerability summary

CVE-2026-107808 is a high (CVSS 8.1) Improper Authentication vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
• CWE-308Use of Single-factor AuthenticationThe product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.