CVE-2026-107808

Summary

Nginx UI allows attackers to bypass passkey-based two-factor authentication by logging in with just a password when EnabledPasskey is set but no TOTP secret exists. This creates a false sense of security where accounts appear to have 2FA enabled but can be fully compromised with just the password.

Exploitability

Moderately difficult to exploit as it requires knowledge of a valid username and password, plus the ability to access the login endpoint, but the vulnerability is exploitable without needing the registered passkey.

Blast radius

Affects all Nginx UI installations between versions 2.0.0 and 2.5.0 where accounts are configured with passkeys but no TOTP backup, potentially allowing full administrative access to affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.5.0 or later to fix the passkey authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.