CVE-2026-84313

Summary

Nginx UI allows attackers with stolen JWT tokens to bypass password verification during TOTP enrollment and passkey registration, creating persistent backdoor access that survives password changes. This affects both new and existing user accounts.

Exploitability

Moderately easy to exploit with a stolen JWT token, requiring only access to the affected API endpoints without needing the victim's current password.

Blast radius

A successful exploitation can grant attackers persistent access to victim accounts that remains valid even after password changes, potentially affecting multiple users across the Nginx UI instance.

Detection

Monitor for POST requests to /api/otp_enroll and /api/finish_passkey_register endpoints with valid JWT tokens but without corresponding password verification logs, particularly when these requests occur outside of normal user session patterns.

Prioritized remediation

Upgrade to version 2.4.1 or later to fix the authentication bypass in OTP enrollment and passkey registration endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.