CVE-2026-107804

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.

• CWE-346

• https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9h23-53f4-q947

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1078An arbitrary file-write vulnerability in Pega Browser Extens…7.2
• CVE-2026-10780The Static Block plugin for WordPress is vulnerable to Insec…4.3
• CVE-2026-107800Jivejdon through 5.0 contains a stored cross-site scripting …5.4
• CVE-2026-107801Jivejdon through 5.0 contains a stored cross-site scripting …5.4
• CVE-2026-107802SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…7.1
• CVE-2026-107803ProcessMaker is an open source workflow management software …6.5
• CVE-2026-107805Nginx UI is a web user interface for the Nginx web server. F…7.5
• CVE-2026-107806Nginx UI is a web user interface for the Nginx web server. F…9.4
• CVE-2026-107807Nginx UI is a web user interface for the Nginx web server. F…8.8
• CVE-2026-107808Nginx UI is a web user interface for the Nginx web server. F…8.1
• CVE-2026-107809Nginx UI is a web user interface for the Nginx web server. F…8.8
• CVE-2026-107810Nginx UI is a web user interface for the Nginx web server. F…8.1