Is CVE-2026-84313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84313 being exploited in the wild.

How severe is CVE-2026-84313?

High severity, with a CVSS score of 8.8, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) SEMVER:introduced=0; Nginx-UI (Go) .

How is CVE-2026-84313 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84313?

Check whether you run github.com/0xJacky/Nginx-UI (Go), Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84313: Nginx UI TOTP and passkey enrollment missing re-authentication

CVE-2026-84313 · Severity: high · CVSS 8.8 · Published 2026-10-12

Nginx UI's two-factor authentication enrollment endpoints lack password re-entry checks, allowing an attacker with a stolen session token to attach their own authenticator to a victim's account. Once enrolled, the attacker's authenticator becomes required for all logins, persisting even after password changes and locking out the legitimate user.

Technologies: github.com/0xJacky/Nginx-UI (Go). Vendors: Go, NGINX.

Quick answers

Is CVE-2026-84313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84313 being exploited in the wild.
How severe is CVE-2026-84313?: High severity, with a CVSS score of 8.8, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) SEMVER:introduced=0; Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0; Nginx UI <UNKNOWN>.
Is there a fix for CVE-2026-84313?: Yes. Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Until then: Monitor the `users` table for unexpected `OTPSecret` values and the `passkeys` table for unexpected rows to detect unauthorized second-factor enrollment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84313 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84313?: Check whether you run github.com/0xJacky/Nginx-UI (Go), Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later
```
go get Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
```

Monitor the `users` table for unexpected `OTPSecret` values and the `passkeys` table for unexpected rows to detect unauthorized second-factor enrollment.

Technical details

The TOTP enrollment (`POST /api/otp_enroll`) and passkey registration (`POST /api/finish_passkey_register`) endpoints require only a valid JWT and are registered outside the secure-session middleware group. An attacker can supply their own TOTP secret or passkey, with the server validating only that the provided passcode matches the supplied secret—no current-password verification occurs. This enables persistent account takeover and is exacerbated by a separate RequireSecureSession bypass affecting non-OTP users.

Affected products

Nginx Nginx UI <UNKNOWN>

Identifiers

CVE-2026-84313
GHSA-gfrc-g87h-7h5w
GO-2026-6786

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.