https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 20:07:36 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84313 <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user&#39;s authentication. This issue is fixed in version 2.4.1.</p> <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user&#39;s authentication. This issue is fixed in version 2.4.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84313 https://db.gcve.eu/vuln/ghsa-gfrc-g87h-7h5w <p><strong>Affected:</strong> Go: Nginx-UI</p> <p>## Summary</p> <p>Endpoints that bind a TOTP secret (`POST /api/otp_enroll`) or register a WebAuthn passkey (`POST /api/finish_passkey_register`) for the *current* user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered **outside** the `RequireSecureSession()` group. With only a stolen JWT, an attacker can attach their own second factor to the victim&#39;s account, surviving any subsequent password rotation and locking the legitimate user out.</p> <p>## Details</p> <p>`api/user/router.go:34-39` — note the routes registered *before* the secure-session group:</p> <p>```go r.GET(&#34;/otp_secret&#34;, GenerateTOTP) r.POST(&#34;/otp_enroll&#34;, EnrollTOTP) // ← outside RequireSecureSession r.GET(&#34;/begin_passkey_register&#34;, BeginPasskeyRegistration) r.POST(&#34;/finish_passkey_register&#34;, FinishPasskeyRegistration) // ← outside RequireSecureSession</p> <p>o := r.Group(&#34;&#34;, middleware.RequireSecureSession()) { o.GET(&#34;/otp_reset&#34;, ResetOTP) // reset *is* protected — inconsistent ... } ```</p> <p>`EnrollTOTP` (`api/user/otp.go:45-102`) only refuses if `cUser.EnabledOTP()` is already `true`; for any victim who has never enabled TOTP it accepts an attacker-supplied `Secret` and `Passcode` pair (the validator only checks that the passcode is a valid TOTP for the supplied secret — i.e., the attacker proves they know the secret they are submitting):</p> <p>```go if cUser.EnabledOTP() { ... abort ... } var twoFA struct { Secret string `json:&#34;secre…</p> <p><strong>Affected:</strong> Go: Nginx-UI</p> <p>## Summary</p> <p>Endpoints that bind a TOTP secret (`POST /api/otp_enroll`) or register a WebAuthn passkey (`POST /api/finish_passkey_register`) for the *current* user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered **outside** the `RequireSecureSession()` group. With only a stolen JWT, an attacker can attach their own second factor to the victim&#39;s account, surviving any subsequent password rotation and locking the legitimate user out.</p> <p>## Details</p> <p>`api/user/router.go:34-39` — note the routes registered *before* the secure-session group:</p> <p>```go r.GET(&#34;/otp_secret&#34;, GenerateTOTP) r.POST(&#34;/otp_enroll&#34;, EnrollTOTP) // ← outside RequireSecureSession r.GET(&#34;/begin_passkey_register&#34;, BeginPasskeyRegistration) r.POST(&#34;/finish_passkey_register&#34;, FinishPasskeyRegistration) // ← outside RequireSecureSession</p> <p>o := r.Group(&#34;&#34;, middleware.RequireSecureSession()) { o.GET(&#34;/otp_reset&#34;, ResetOTP) // reset *is* protected — inconsistent ... } ```</p> <p>`EnrollTOTP` (`api/user/otp.go:45-102`) only refuses if `cUser.EnabledOTP()` is already `true`; for any victim who has never enabled TOTP it accepts an attacker-supplied `Secret` and `Passcode` pair (the validator only checks that the passcode is a valid TOTP for the supplied secret — i.e., the attacker proves they know the secret they are submitting):</p> <p>```go if cUser.EnabledOTP() { ... abort ... } var twoFA struct { Secret string `json:&#34;secre…</p> https://db.gcve.eu/vuln/ghsa-gfrc-g87h-7h5w