Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84315— Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Quick assessment

Affected
0xJacky nginx-ui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nginx UI 是 Nginx Web 服务器的 Web 用户界面。在 2.4.1 版本之前，即使启用了 OTP（一次性密码）的用户在执行敏感操作时应提供最新的 ，Nginx UI 也未对多个经过身份验证的变更（mutation）路由应用 限制。因此，攻击者若窃取了一个已认证的会话，便可在未完成 OTP 或 passkey 的增强认证步骤的情况下，创建或修改自动备份、DNS 凭据和记录、证书及 ACME 用户、Nginx 控制设置，以及站点或流媒体自动化配置。该问题已在 2.4.1 版本中得到修复。

CVSS 8.3 · High

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84315

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Source: CVE Program / CVE List V5
Vulnerability Description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
0xJacky nginx-ui < 2.4.1 -

II. Public POCs for CVE-2026-84315

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84315

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-84315 (1)

Same Patch Batch · 0xJacky · 2026-10-12 · 11 CVEs total

CVE-2026-84318 8.8 HIGH Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
CVE-2026-84313 8.8 HIGH Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent acco
CVE-2026-84316 8.8 HIGH Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line
CVE-2026-84317 8.8 HIGH Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx dir
CVE-2026-84314 8.7 HIGH Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
CVE-2026-84319 8.3 HIGH Nginx UI: MCP configuration tools bypass restricted directive validation and allow seconda
CVE-2026-84360 8.1 HIGH Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
CVE-2026-84312 7.1 HIGH Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
CVE-2026-84320 6.3 MEDIUM Nginx UI: Auto backup name allows path traversal outside validated storage path
CVE-2026-84321 5.4 MEDIUM Nginx UI: Standalone short tokens survive administrative revocation in cache and authentic

IV. Related Vulnerabilities

Same product: nginx-ui
Same vendor: 0xJacky
Same weakness: CWE-862

V. Comments for CVE-2026-84315

No comments yet

Leave a comment