Listen to this Post
CVE-2026-107808 represents a critical authentication and authorization design flaw residing within the Nginx UI management platform, specifically impacting second-factor authentication enforcement for accounts configured exclusively with WebAuthn passkeys without a fallback TOTP secret. The root cause stems from a severe validation mismatch between the application’s global 2FA policy definition and its active login execution handler. In the underlying user model definitions, the policy function correctly evaluates an account as requiring two-factor protection if either a TOTP secret is present or a registered passkey row exists. However, during the primary password authentication routine within the login handler endpoint, the verification logic strictly queries only the presence of a TOTP configuration vector, completely omitting any validation branch for WebAuthn passkey assertions. Consequently, when a user account has registered a passkey but lacks a TOTP secret, providing the correct account password satisfies the entire login workflow. The system bypasses the required second factor entirely, issuing a valid JSON Web Token and silently downgrading a multi-factor security posture down to a vulnerable single-factor password-only state. Furthermore, this discrepancy extends into secure session middleware handlers, exempting passkey-only accounts from mandatory step-up challenges during sensitive administrative actions and management operations.
DailyCVE Form:
Platform: Nginx UI
Version: Up 2.5.0
Vulnerability: Bypass flaw
Severity: High risk
Date: May 2026
Prediction: Version 2.6
What Undercode Say:
Verify vulnerable code implementation path in source repository git log -S "EnabledOTP" --oneline grep -rn "EnabledOTP" api/user/auth.go
// Flawed enforcement snippet found in login handler
if u.EnabledOTP() {
if json.OTP == "" && json.RecoveryCode == "" {
c.JSON(http.StatusOK, LoginResponse{Message: "The user has enabled 2FA", Code: Enabled2FA})
user.BanIP(clientIP)
return
}
if _, err = user.VerifyOTP(u, json.OTP, json.RecoveryCode); err != nil { / ... / }
secureSessionID = user.SetSecureSessionID(u.ID)
}
accessToken, err := user.GenerateJWT(u)
Exploit: (Educational Purposes!)
Test login against a passkey-only user account without TOTP configured
curl -X POST http://127.0.0.1:9000/api/login \
-H "Content-Type: application/json" \
-d '{"name": "victim_user", "password": "TargetPassword123"}'
Response returns HTTP status code 200 containing a valid JWT session token, successfully bypassing the required WebAuthn security key assertion step entirely.
Protection: from this CVE
Update the login handler logic to evaluate `u.Enabled2FA()` instead of relying exclusively on u.EnabledOTP().
Enforce the WebAuthn passkey challenge flow (begin_passkey_login / finish_passkey_login) for accounts utilizing passkeys.
Apply consistent session verification checks within `RequireSecureSession()` middleware to prevent step-up exemptions.
Impact:
Complete silent downgrade of security posture from multi-factor authentication to single-factor password access.
Unauthorized administrative account access if account passwords are exposed through leaks, credential stuffing, or phishing campaigns.
Complete takeover of managed Nginx instances and underlying host systems due to high administrative privileges and shell execution features inherent to Nginx UI.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
