Nginx UI Passkey Bypass Lets Attackers Bypass 2FA in Versions Before 2.5.0
A flaw in Nginx UI allows password-only login for passkey-protected accounts, bypassing second-factor authentication in versions prior to 2.5.0.
Key points
- Nginx UI versions 2.0.0 through 2.4.x fail to enforce WebAuthn passkeys during password login.
- The vulnerability, CVE-2026-107808, is rated High severity with a CVSS score of 8.1.
- Users with passkeys but no TOTP secret are issued session tokens after password verification alone.
Nginx UI has a high-severity authentication bypass that allows attackers to take over administrative accounts using only a password, even when two-factor authentication is enabled via passkeys. The flaw affects versions from 2.0.0 up to, but not including, 2.5.0.
At a glance
- CVE
- CVE-2026-107808
- Product
- 0xJacky nginx-ui
- CVSS
- 8.1 High
- Weakness
- improper authentication
- Exploited
- No known exploitation
The vulnerability, tracked as CVE-2026-107808, stems from a mismatch between how the application defines two-factor authentication and how it enforces it during the login process. According to the National Vulnerability Database and GitHub advisory GHSA-45gv-9wjv-xh7p, the application considers an account protected if either a Time-based One-Time Password (TOTP) secret or a WebAuthn passkey is configured. However, the login endpoint only checks for the presence of a TOTP secret. If an account has a registered passkey but no TOTP secret, the system skips the second-factor step entirely and issues a session token after the password is verified.
Authentication Logic Flaw
The root cause lies in the code handling the `POST /api/login` request. The application’s user model reports that two-factor authentication is enabled if either `EnabledOTP()` or `EnabledPasskey()` returns true. This status is exposed to the user interface, leading administrators to believe their accounts are protected by a second factor.
However, the login handler only invokes the `EnabledOTP()` check. If this returns false—which it does for passkey-only accounts—the code proceeds to generate a JSON Web Token (JWT) without requesting a WebAuthn assertion. This effectively downgrades passkey-protected accounts to single-factor authentication. An attacker who obtains a user’s password can bypass the intended security controls and gain full administrative access without needing the registered passkey.
Affected Versions and Fix
The issue affects Nginx UI, a web user interface for the Nginx web server developed by 0xJacky. According to the GitHub advisory, the vulnerability exists in Go packages from version 1.9.10-0.20250517140552-daee3ac7ade1 up to 1.9.10-0.20260728074558-95cd21b70814. The flaw is resolved in version 2.5.0. The CVSS score of 8.1 classifies the severity as High. The weaknesses associated with this CVE include CWE-287 (Improper Authentication), CWE-305 (Authentication Bypass Using an Alternate Path), and CWE-308 (Use of Single-factor Authentication).
What should you do?
Administrators using Nginx UI should verify their current version immediately. If running a version prior to 2.5.0, upgrade to the patched release as soon as possible. Until an upgrade is performed, consider enforcing TOTP for all administrative accounts to ensure the second-factor check is triggered, as passkey-only configurations are vulnerable. Monitor access logs for successful logins that lack corresponding multi-factor authentication tokens, which may indicate exploitation.
What to do and how to stay safe: Nginx UI
- Check your Nginx UI version and upgrade to 2.5.0 or later once the vendor provides the update.
- Enforce TOTP-based two-factor authentication for all administrative accounts to ensure the login handler triggers the second-factor check.
- Review authentication logs for sessions established via password-only login for accounts that should require passkeys.
- Restrict access to the Nginx UI management interface to trusted IP addresses or networks to reduce exposure.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Nginx UI are vulnerable to CVE-2026-107808?
Versions from 2.0.0 up to, but not including, 2.5.0 are affected by this authentication bypass.
Does this vulnerability affect accounts using TOTP?
No, the login handler correctly enforces the second factor when a TOTP secret is configured; it only fails for passkey-only accounts.
Is there a fix available for this issue?
Yes, the issue is fixed in Nginx UI version 2.5.0.
