CVE-2026-93964

Name of the Vulnerable Software and Affected Versions nginx-proxy-manager versions prior to 2.15.2

Description Missing authentication in the Validate Route component allows remote attackers to manipulate the internalCertificate.validate() function within the backend/internal/certificate.js file. The endpoint processes and echoes back the submitted certificate, leading to unauthenticated OpenSSL processing of attacker-controlled input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.