# CVE-2026-84314: nginx-ui account takeover via missing 2FA on user password change

Source: https://junglewise.ai/threats/cve-2026-84314-nginx-ui-account-takeover-via-missing-requiresecuresession-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-84314 · Severity: high · CVSS 4 · Published 2026-10-12

nginx-ui is a web-based administration interface for the nginx web server. An authenticated attacker can change any user's password, including the initial admin account, without providing 2FA verification. This allows complete account takeover of the admin account and locks out the legitimate administrator.

Technologies: [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui), [Nginx UI](https://junglewise.ai/threats/technologies/nginx-ui-nginx-ui). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Nginx UI](https://junglewise.ai/threats/vendors/nginx-ui).

## Quick answers

**Is CVE-2026-84314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84314 being exploited in the wild.

**How severe is CVE-2026-84314?** High severity, with a CVSS score of 4, published 12 October 2026.

**Which products and versions are affected?** github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0; Nginx UI <unknown.

**Is there a fix for CVE-2026-84314?** Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84314 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84314?** Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later

  ```sh
  go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
  ```


## Technical details

The POST /api/users/:id endpoint for password changes is missing the RequireSecureSession middleware that enforces 2FA verification, while the self-password change endpoint correctly implements it. Any authenticated user can exploit this to change another user's password by sending a JSON request with a new password, bypassing all 2FA protections even if enabled on the target account.

## Affected products

- nginx-ui nginx-ui <unknown

## Identifiers

- CVE-2026-84314
- GHSA-2gc7-j998-5xx6
- GO-2026-6771

## Timeline

- 2026-10-15: disclosed

## Related threats

- [Nginx UI Casdoor SSO login CSRF via constant state parameter](https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter)
- [Nginx UI OTP secure-session step-up bypass via MCP](https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp)
- [Nginx UI short token cache bypass after account re-enable](https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative)
- [Nginx UI auto backup path traversal in storage boundary](https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated)
- [Nginx UI MCP configuration directive validation bypass](https://junglewise.ai/threats/cve-2026-84319-nginx-ui-mcp-configuration-tools-bypass-restricted-directive)