Is CVE-2026-107808 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107808 being exploited in the wild.

How severe is CVE-2026-107808?

High severity, with a CVSS score of 8.1, published 9 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074558-95cd21b70814.

How is CVE-2026-107808 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107808?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107808: nginx-ui authentication bypass in password login with passkey-only 2FA

Q: Is there a fix for CVE-2026-107808?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074558-95cd21b70814 or later. Until then: Restrict nginx-ui access to a private network or VPN until patched. Enforce TOTP in addition to or instead of passkeys as the sole 2FA method. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107808 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107808?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107808 · Severity: high · CVSS 8.1 · Published 2026-10-09

nginx-ui is a configuration management interface for nginx servers that supports two-factor authentication via TOTP and security keys (WebAuthn passkeys). An account protected only by a passkey can be logged into using just the password, completely bypassing the second factor. An attacker with only a stolen password gains full administrative access to the nginx instance and can execute arbitrary commands on the host system.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx-Ui. Vendors: Go.

Quick answers

Is CVE-2026-107808 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107808 being exploited in the wild.
How severe is CVE-2026-107808?: High severity, with a CVSS score of 8.1, published 9 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074558-95cd21b70814.
Is there a fix for CVE-2026-107808?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074558-95cd21b70814 or later. Until then: Restrict nginx-ui access to a private network or VPN until patched. Enforce TOTP in addition to or instead of passkeys as the sole 2FA method. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107808 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107808?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074558-95cd21b70814 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728074558-95cd21b70814
```

Restrict nginx-ui access to a private network or VPN until patched. Enforce TOTP in addition to or instead of passkeys as the sole 2FA method.

Technical details

The login handler in api/user/auth.go checks only for TOTP (EnabledOTP()) when enforcing two-factor authentication, ignoring accounts with WebAuthn passkeys (EnabledPasskey()). The account policy correctly treats both as valid 2FA methods via Enabled2FA(), but the enforcement code uses a subset condition. When a user has registered a passkey but no TOTP secret, password verification alone grants a full JWT session token; the passkey is never requested. The same issue affects the RequireSecureSession() middleware for step-up authentication on sensitive operations.

Affected products

nginx-ui

Identifiers

CVE-2026-107808
GHSA-45gv-9wjv-xh7p
GO-2026-6704

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.