Vulnerability-Lookup

CVE-2026-107809 (GCVE-0-2026-107809)

Vulnerability from cvelistv5 – Published: 2026-10-09 15:22 – Updated: 2026-10-09 16:45

Title

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 16:16 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7640 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/0xJacky/nginx-ui/security/advi…	x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/commit/a3999b…	x_refsource_MISC
https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
0xJacky	nginx-ui	Affected: >= 2.0.0, < 2.5.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T16:16:13.986272Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T16:45:22.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator\u0027s browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim\u0027s session. This issue is fixed in version 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T15:22:10.562Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-33rr-wq23-g6gg",
        "discovery": "UNKNOWN"
      },
      "title": "Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107809",
    "datePublished": "2026-10-09T15:22:10.562Z",
    "dateReserved": "2026-10-08T21:23:59.821Z",
    "dateUpdated": "2026-10-09T16:45:22.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107809",
      "date": "2026-10-10",
      "epss": "0.00185",
      "percentile": "0.07447"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "nginx-ui",
                "vendor": "0xJacky",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0, \u003c 2.5.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator\u0027s browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim\u0027s session. This issue is fixed in version 2.5.0."
          }
        ],
        "id": "CVE-2026-107809",
        "lastModified": "2026-10-09T17:16:45.730",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-107809",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T16:16:13.986272Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-09T16:17:25.387",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-107809",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-09T16:16:13.986272Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-09T16:16:14.592Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "nginx-ui",
              "vendor": "0xJacky",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0, \u003c 2.5.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator\u0027s browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim\u0027s session. This issue is fixed in version 2.5.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-09T15:22:10.562Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg"
            },
            {
              "name": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
            },
            {
              "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
            }
          ],
          "source": {
            "advisory": "GHSA-33rr-wq23-g6gg",
            "discovery": "UNKNOWN"
          },
          "title": "Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-107809",
        "datePublished": "2026-10-09T15:22:10.562Z",
        "dateReserved": "2026-10-08T21:23:59.821Z",
        "dateUpdated": "2026-10-09T16:45:22.243Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-107809

Vulnerability from fkie_nvd - Published: 2026-10-09 16:17 - Updated: 2026-10-09 17:16

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954
	security-advisories@github.com	https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0
	security-advisories@github.com	https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.5.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator\u0027s browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim\u0027s session. This issue is fixed in version 2.5.0."
    }
  ],
  "id": "CVE-2026-107809",
  "lastModified": "2026-10-09T17:16:45.730",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107809",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-09T16:16:13.986272Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-09T16:17:25.387",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-33RR-WQ23-G6GG

Vulnerability from github – Published: 2026-10-09 17:08 – Updated: 2026-10-09 17:08

Summary

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Details

Summary

Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attacker can induce a logged-in administrator to submit cross-site state-changing requests. The attacker does not need to read the cross-origin response; the browser-sent cookie is enough to authenticate the request.

Details

The root cause is a trust-boundary failure between browser-managed cookies and API bearer-token authentication. In app/src/pinia/moudule/user.ts:25-35, the front end writes the JWT to a token cookie when the token changes. In internal/middleware/middleware.go:16-36, getToken first checks the Authorization header and token query parameter, then falls back to c.Cookie("token"). That fallback causes browser-initiated cross-site requests to carry a valid API credential automatically. The route group in router/routers.go:87-110 applies middleware.AuthRequired() to many management modules, including config.InitRouter, nginx.InitRouter, settings.InitRouter, and backup-related handlers. For accounts without OTP/Passkey, RequireSecureSession does not provide a universal second factor for all state-changing operations. A representative sink is api/config/add.go:68-78, where an authenticated request writes Nginx configuration with os.WriteFile and then calls nginx.Control(nginx.Reload). CORS does not mitigate this issue because preventing cross-origin response reads does not prevent cross-site form or no-cors requests from being sent with cookies.

Core vulnerable code path:

// app/src/pinia/moudule/user.ts:25-35
watch(token, v => {
    if (v) {
      cookies.set('token', v, getCookieOptions(86400))
      if (!shortToken.value) {
        void fetchShortToken()
      }
    }
    else {
      cookies.remove('token', { path: '/' })
      shortToken.value = ''
    }
  })

The front end stores the authentication token in a token cookie. The cookie is created client-side and is not shown here as HttpOnly; it becomes the credential that the back end later accepts through cookie fallback.

// internal/middleware/middleware.go:16-36
// getToken from header, cookie or query
func getToken(c *gin.Context) (token string) {
    if token = c.GetHeader("Authorization"); token != "" {
        return
    }

    if token = c.Query("token"); token != "" {
        if len(token) > 16 {
            // Long token (base64 encoded JWT)
            tokenBytes, _ := base64.StdEncoding.DecodeString(token)
            return string(tokenBytes)
        }
        // Short token (16 characters)
        return token
    }

    if token, _ = c.Cookie("token"); token != "" {
        return token
    }

    return ""
}

getToken accepts the token cookie as an authentication credential after checking the header and query parameter. That behavior lets a browser-sent cookie authenticate state-changing API requests triggered from another origin.

// router/routers.go:87-110
// Authorization required and not websocket request
        g := root.Group("/", middleware.AuthRequired(), middleware.Proxy())
        {
            debug.InitRouter(g)
            user.InitUserRouter(g)
            analytic.InitRouter(g)
            user.InitManageUserRouter(g)
            nginx.InitRouter(g)
            sites.InitRouter(g)
            streams.InitRouter(g)
            config.InitRouter(g)
            template.InitRouter(g)
            certificate.InitCertificateRouter(g)
            certificate.InitDNSCredentialRouter(g)
            certificate.InitAcmeUserRouter(g)
            dnsapi.InitRouter(g)
            system.InitPrivateRouter(g)
            settings.InitRouter(g)
            llm.InitRouter(g)
            cluster.InitRouter(g)
            notification.InitRouter(g)
            external_notify.InitRouter(g)
            backup.InitAutoBackupRouter(g)
            nginxLog.InitRouter(g)
            upstream.InitHTTPRouter(g)

Many management modules, including Nginx, configuration, settings, backup, and user management, are placed behind AuthRequired. The cookie fallback therefore protects high-impact state-changing routes, not only read-only endpoints.

// api/config/add.go:68-78
err = os.WriteFile(path, []byte(content), 0644)
    if err != nil {
        cosy.ErrHandler(c, err)
        return
    }

    res := nginx.Control(nginx.Reload)
    if res.IsError() {
        res.RespError(c)
        return
    }

This representative sink shows why the CSRF is high impact: once authenticated through the cookie fallback, a request can write Nginx configuration content and trigger a reload.

POC

Prerequisites: an administrator is logged in to Nginx-UI and has a browser token cookie; the administrator account has not enabled OTP/Passkey, or the chosen target endpoint does not require secure-session proof; the attacker knows the Nginx-UI management URL and can induce the administrator to visit an attacker-controlled page. Reproduction: (1) Host an attacker page at GET /csrf.html that automatically submits a cross-site request to the victim instance. (2) The page submits POST /api/configs with configuration fields such as base_dir, name, content, overwrite, and sync_node_ids; the attacker does not need to read the response. (3) When the administrator visits the page, the browser attaches the victim site's token cookie. (4) Expected result: AuthRequired authenticates from the cookie, AddConfig writes the Nginx configuration, and the application attempts an Nginx reload. Testing should use a harmless configuration in an isolated environment.

Impact

An attacker can trigger administrative operations while an administrator is logged in, including Nginx configuration creation or modification, reload/restart operations, settings changes, and backup-related actions depending on endpoint protections. Direct impacts include traffic redirection, reverse proxy tampering, denial of service, and sensitive configuration changes. In deployments with permissive Nginx modules or dangerous configuration capabilities, configuration tampering may lead to further server-side impact or internal network abuse.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.10-0.20250517140552-daee3ac7ade1"
            },
            {
              "fixed": "1.9.10-0.20260728074433-a3999bd78a3b"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107809"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T17:08:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nNginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accepts that cookie as an authentication source. Because management endpoints are protected by `AuthRequired` and do not enforce a universal CSRF token or Origin/Referer check, a remote attacker can induce a logged-in administrator to submit cross-site state-changing requests. The attacker does not need to read the cross-origin response; the browser-sent cookie is enough to authenticate the request.\n\n## Details\nThe root cause is a trust-boundary failure between browser-managed cookies and API bearer-token authentication. In `app/src/pinia/moudule/user.ts:25-35`, the front end writes the JWT to a `token` cookie when the token changes. In `internal/middleware/middleware.go:16-36`, `getToken` first checks the `Authorization` header and `token` query parameter, then falls back to `c.Cookie(\"token\")`. That fallback causes browser-initiated cross-site requests to carry a valid API credential automatically. The route group in `router/routers.go:87-110` applies `middleware.AuthRequired()` to many management modules, including `config.InitRouter`, `nginx.InitRouter`, `settings.InitRouter`, and backup-related handlers. For accounts without OTP/Passkey, `RequireSecureSession` does not provide a universal second factor for all state-changing operations. A representative sink is `api/config/add.go:68-78`, where an authenticated request writes Nginx configuration with `os.WriteFile` and then calls `nginx.Control(nginx.Reload)`. CORS does not mitigate this issue because preventing cross-origin response reads does not prevent cross-site form or no-cors requests from being sent with cookies.\n\nCore vulnerable code path:\n\n```typescript\n// app/src/pinia/moudule/user.ts:25-35\nwatch(token, v =\u003e {\n    if (v) {\n      cookies.set(\u0027token\u0027, v, getCookieOptions(86400))\n      if (!shortToken.value) {\n        void fetchShortToken()\n      }\n    }\n    else {\n      cookies.remove(\u0027token\u0027, { path: \u0027/\u0027 })\n      shortToken.value = \u0027\u0027\n    }\n  })\n```\n\nThe front end stores the authentication token in a `token` cookie. The cookie is created client-side and is not shown here as HttpOnly; it becomes the credential that the back end later accepts through cookie fallback.\n\n```go\n// internal/middleware/middleware.go:16-36\n// getToken from header, cookie or query\nfunc getToken(c *gin.Context) (token string) {\n\tif token = c.GetHeader(\"Authorization\"); token != \"\" {\n\t\treturn\n\t}\n\n\tif token = c.Query(\"token\"); token != \"\" {\n\t\tif len(token) \u003e 16 {\n\t\t\t// Long token (base64 encoded JWT)\n\t\t\ttokenBytes, _ := base64.StdEncoding.DecodeString(token)\n\t\t\treturn string(tokenBytes)\n\t\t}\n\t\t// Short token (16 characters)\n\t\treturn token\n\t}\n\n\tif token, _ = c.Cookie(\"token\"); token != \"\" {\n\t\treturn token\n\t}\n\n\treturn \"\"\n}\n```\n\n`getToken` accepts the `token` cookie as an authentication credential after checking the header and query parameter. That behavior lets a browser-sent cookie authenticate state-changing API requests triggered from another origin.\n\n```go\n// router/routers.go:87-110\n// Authorization required and not websocket request\n\t\tg := root.Group(\"/\", middleware.AuthRequired(), middleware.Proxy())\n\t\t{\n\t\t\tdebug.InitRouter(g)\n\t\t\tuser.InitUserRouter(g)\n\t\t\tanalytic.InitRouter(g)\n\t\t\tuser.InitManageUserRouter(g)\n\t\t\tnginx.InitRouter(g)\n\t\t\tsites.InitRouter(g)\n\t\t\tstreams.InitRouter(g)\n\t\t\tconfig.InitRouter(g)\n\t\t\ttemplate.InitRouter(g)\n\t\t\tcertificate.InitCertificateRouter(g)\n\t\t\tcertificate.InitDNSCredentialRouter(g)\n\t\t\tcertificate.InitAcmeUserRouter(g)\n\t\t\tdnsapi.InitRouter(g)\n\t\t\tsystem.InitPrivateRouter(g)\n\t\t\tsettings.InitRouter(g)\n\t\t\tllm.InitRouter(g)\n\t\t\tcluster.InitRouter(g)\n\t\t\tnotification.InitRouter(g)\n\t\t\texternal_notify.InitRouter(g)\n\t\t\tbackup.InitAutoBackupRouter(g)\n\t\t\tnginxLog.InitRouter(g)\n\t\t\tupstream.InitHTTPRouter(g)\n```\n\nMany management modules, including Nginx, configuration, settings, backup, and user management, are placed behind `AuthRequired`. The cookie fallback therefore protects high-impact state-changing routes, not only read-only endpoints.\n\n```go\n// api/config/add.go:68-78\nerr = os.WriteFile(path, []byte(content), 0644)\n\tif err != nil {\n\t\tcosy.ErrHandler(c, err)\n\t\treturn\n\t}\n\n\tres := nginx.Control(nginx.Reload)\n\tif res.IsError() {\n\t\tres.RespError(c)\n\t\treturn\n\t}\n```\n\nThis representative sink shows why the CSRF is high impact: once authenticated through the cookie fallback, a request can write Nginx configuration content and trigger a reload.\n\n## POC\nPrerequisites: an administrator is logged in to Nginx-UI and has a browser `token` cookie; the administrator account has not enabled OTP/Passkey, or the chosen target endpoint does not require secure-session proof; the attacker knows the Nginx-UI management URL and can induce the administrator to visit an attacker-controlled page. Reproduction: (1) Host an attacker page at `GET /csrf.html` that automatically submits a cross-site request to the victim instance. (2) The page submits `POST /api/configs` with configuration fields such as `base_dir`, `name`, `content`, `overwrite`, and `sync_node_ids`; the attacker does not need to read the response. (3) When the administrator visits the page, the browser attaches the victim site\u0027s `token` cookie. (4) Expected result: `AuthRequired` authenticates from the cookie, `AddConfig` writes the Nginx configuration, and the application attempts an Nginx reload. Testing should use a harmless configuration in an isolated environment.\n\n## Impact\nAn attacker can trigger administrative operations while an administrator is logged in, including Nginx configuration creation or modification, reload/restart operations, settings changes, and backup-related actions depending on endpoint protections. Direct impacts include traffic redirection, reverse proxy tampering, denial of service, and sensitive configuration changes. In deployments with permissive Nginx modules or dangerous configuration capabilities, configuration tampering may lead to further server-side impact or internal network abuse.",
  "id": "GHSA-33rr-wq23-g6gg",
  "modified": "2026-10-09T17:08:10Z",
  "published": "2026-10-09T17:08:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107809 (GCVE-0-2026-107809)

FKIE_CVE-2026-107809

GHSA-33RR-WQ23-G6GG

Summary

Details

POC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour