CVE-2026-84313 - Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
CVE ID :CVE-2026-84313 Published : Oct. 12, 2026, 9:17 p.m. | 14 minutes ago Description :Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal...