{"metadata": {"vulnerability": "CVE-2026-84313", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-01T16:17:43.079Z", "date_only": false, "value": "2026-09-01T16:17:43.079Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-84313", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T20:51:44.751Z", "date_only": false, "value": "2026-10-12T20:51:44.751Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-84313", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T20:51:44.751Z", "date_only": false, "value": "2026-10-12T20:51:44.751Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-84313", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T21:17:21Z", "date_only": false, "value": "2026-10-12T21:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GFRC-G87H-7H5W", "record": "GHSA-GFRC-G87H-7H5W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T21:17:21.597Z", "date_only": false, "value": "2026-10-12T21:17:21.597", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84313", "record": "FKIE_CVE-2026-84313", "field": "published"}, {"timestamp": "2026-10-12T21:48:32.044Z", "date_only": false, "value": "2026-10-12T21:48:32.044289Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430138402337709", "record": "CVE-2026-84313", "field": "creation_timestamp", "uuid": "582c9ffc-8f42-4e12-8fac-56c23d5c45ea", "content": "CVE-2026-84313 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84313https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5whttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1#0xJacky #nginx-ui#CVE_2026_84313#bot", "url": "https://infosec.exchange/users/cve/statuses/117430138402337709"}, {"timestamp": "2026-10-15T08:03:50.965Z", "date_only": false, "value": "2026-10-15T08:03:50.965042Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mxvlyiughs2d", "record": "CVE-2026-84313", "field": "creation_timestamp", "uuid": "b3bd02f4-c080-4386-b414-7d2d50256040", "content": "New HIGH CVE for nginx: CVE-2026-84313\n\nNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal auth\u2026\n\nMore: nvd.nist.gov/vuln/detail/CVE-2026-84313", "url": "https://bsky.app/profile/bootintel.bsky.social/post/3mxvlyiughs2d"}, {"timestamp": "2026-10-15T13:48:05.211Z", "date_only": false, "value": "2026-10-15T13:48:05.211053Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-84313", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T13:48:05.211Z", "date_only": false, "value": "2026-10-15T13:48:05.211053Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84313", "record": "FKIE_CVE-2026-84313", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T13:48:40.557Z", "date_only": false, "value": "2026-10-15T13:48:40.557Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-84313", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T13:48:40.557Z", "date_only": false, "value": "2026-10-15T13:48:40.557Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-84313", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T14:17:29.597Z", "date_only": false, "value": "2026-10-15T14:17:29.597", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84313", "record": "FKIE_CVE-2026-84313", "field": "lastModified"}, {"timestamp": "2026-10-15T20:11:32Z", "date_only": false, "value": "2026-10-15T20:11:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GFRC-G87H-7H5W", "record": "GHSA-GFRC-G87H-7H5W", "field": "published"}, {"timestamp": "2026-10-15T20:11:32Z", "date_only": false, "value": "2026-10-15T20:11:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GFRC-G87H-7H5W", "record": "GHSA-GFRC-G87H-7H5W", "field": "modified"}]}