CVE-2026-84313 0xJacky CVE debrief

Who should care

Defenders responsible for Nginx UI deployments should assess exposure and verify the effectiveness of existing authentication and session management controls. This includes reviewing the current version of Nginx UI, assessing authentication and session management controls, and implementing additional authentication factors for TOTP and passkey enrolment. Operators, platform administrators, vulnerability management teams, and security teams should review 2.

Why it matters

CVE-2026-84313 allows an attacker with a stolen JWT to bind an attacker-controlled TOTP secret or register an attacker-controlled passkey without re-authentication, enabling persistent account takeover in Nginx UI prior to version 2.4.1.

• Persistent account access can survive a password change
• Legitimate user's authentication can be interfered with
• Account takeover can occur without requiring re-authentication
• Verification of Nginx UI version and authentication controls is necessary

Technical summary

Nginx UI prior to version 2.4.1 has a vulnerability where an attacker with a stolen JWT can bind an attacker-controlled TOTP secret or register an attacker-controlled passkey without requiring re-authentication. This enables persistent account takeover, allowing an attacker to maintain access even after a password change. The vulnerability exists in the POST /api/otp_enroll and POST /api/finish_passkey_register endpoints, which are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password.

Defensive priority

Defenders should prioritize verifying exposure of Nginx UI versions prior to 2.4.1 and assessing the effectiveness of existing authentication and session management controls.

Recommended defensive actions

• Verify Nginx UI version and ensure it is 2.4.1 or later
• Assess authentication and session management controls for Nginx UI
• Implement additional authentication factors for TOTP and passkey enrolment
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in Nginx UI prior to version 2.4.1, where an attacker with a stolen JWT can bind an attacker-controlled TOTP secret or register an attacker-controlled passkey without requiring re-authentication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.