CVE-2026-107808

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9

Description An authentication bypass exists where the POST /api/login endpoint checks EnabledOTP but fails to require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. This allows a session to be issued after password verification for passkey-only accounts, even if Enabled2FA indicates a second factor is active. An attacker with a valid password can bypass the registered passkey to gain administrative access.

Recommendations Update to version 2.5.0.