Key points
- CVE-2026-107808 affects Nginx UI versions from 2.0.0 up to 2.5.0.
- The login endpoint checks for TOTP secrets but ignores WebAuthn passkeys.
- Version 2.5.0 fixes the authentication bypass vulnerability.
Nginx UI contains an authentication bypass vulnerability that allows attackers to access administrative accounts using only a password. The flaw, identified as CVE-2026-107808, affects software versions released between 2.0.0 and 2.5.0. Security researchers assigned a CVSS score of 8.1, classifying the issue as high severity due to the potential for unauthorized account takeover.
In plain English
The application supports two types of two-factor authentication: time-based one-time passwords and WebAuthn passkeys. The system reports an account as having two-factor authentication enabled if either method is configured. However, the login process only enforces a second step when a time-based password secret is present. If an administrator uses only a passkey, the system skips the second factor entirely after verifying the password.
The background
According to the GitHub advisory GHSA-45gv-9wjv-xh7p, the root cause is a mismatch between policy and enforcement. The user model defines two-factor authentication as true if either a TOTP secret or a passkey exists. The login handler in the code only checks for the TOTP secret. This logic gap means passkey-only users receive a full session token after password verification, effectively downgrading their security posture to single-factor authentication.
What changes now
The vendor has released version 2.5.0 to address this vulnerability. The update corrects the login handler to properly require a WebAuthn assertion when an account has a registered passkey. Users running versions prior to 2.5.0 remain exposed to this bypass. The National Vulnerability Database confirms the fix is available in the latest release, closing the window for password-only access.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: Nginx UI
- Audit Nginx UI installations to identify versions earlier than 2.5.0 and prioritize updates.
- Review account configurations to determine which administrators rely solely on passkeys without TOTP.
- Monitor login logs for successful authentications that lack second-factor verification events.
- Enforce strong password policies to reduce the impact of the bypass until updates are deployed.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Nginx UI versions are vulnerable to CVE-2026-107808?
Versions from 2.0.0 up to, but not including, 2.5.0 are affected by this authentication bypass.
Does this vulnerability affect accounts using TOTP?
No, the flaw specifically impacts accounts that use WebAuthn passkeys without a configured TOTP secret.
Is there a patch available for this issue?
Yes, the vendor has fixed the issue in Nginx UI version 2.5.0, which is available for download.
