Summary
Nginx UI contains an authentication bypass in its login flow for accounts configured to use a passkey as their only second factor. An attacker who obtains a valid password may receive a session without completing the registered WebAuthn assertion and could access administrative functionality.
Nginx UI contains an authentication bypass in its login flow for accounts configured to use a passkey as their only second factor. An attacker who obtains a valid password may receive a session without completing the registered WebAuthn assertion and could access administrative functionality.
Affected context
The issue occurs in Nginx UI deployments using the affected login logic when an account has passkey authentication enabled, no TOTP secret configured, and the account is represented as having two-factor protection. Under these conditions, the password verification path can issue a session without requiring the configured WebAuthn assertion.
The issue occurs in Nginx UI deployments using the affected login logic when an account has passkey authentication enabled, no TOTP secret configured, and the account is represented as having two-factor protection. Under these conditions, the password verification path can issue a session without requiring the configured WebAuthn assertion.
Exploit preconditions
- Attack surface: The web application's login endpoint. - Required access: Knowledge or possession of a target user's valid password. - Trigger point: Password-based login for an account configured for passkey-only
multifactor authentication.
- Why exploitation is possible: The endpoint checks the account's multifactor
state but does not consistently enforce a WebAuthn assertion when no TOTP
secret is present.
- Attack surface: The web application's login endpoint. - Required access: Knowledge or possession of a target user's valid password. - Trigger point: Password-based login for an account configured for passkey-only
multifactor authentication.
- Why exploitation is possible: The endpoint checks the account's multifactor
state but does not consistently enforce a WebAuthn assertion when no TOTP
secret is present.
Why this happens
The login flow treats the presence of an enabled passkey as sufficient multifactor configuration but fails to make successful WebAuthn verification mandatory before creating a session. This is an authentication decision flaw mapped primarily to CWE-287, Improper Authentication, and is also related to CWE-305 and CWE-308 because the application fails to enforce the intended additional authentication factor in a specific authentication path.
The login flow treats the presence of an enabled passkey as sufficient multifactor configuration but fails to make successful WebAuthn verification mandatory before creating a session. This is an authentication decision flaw mapped primarily to CWE-287, Improper Authentication, and is also related to CWE-305 and CWE-308 because the application fails to enforce the intended additional authentication factor in a specific authentication path.
Potential impact
- An attacker may take over a passkey-only user account after obtaining its password.
- The attacker could access administrative functionality available to that account.
- The attacker may modify Nginx UI settings or managed server configurations.
- The incident could enable further compromise of connected services or infrastructure.
- An attacker may take over a passkey-only user account after obtaining its password.
- The attacker could access administrative functionality available to that account.
- The attacker may modify Nginx UI settings or managed server configurations.
- The incident could enable further compromise of connected services or infrastructure.
General mitigation guidance
Mitigation generally focuses on making authentication policy enforcement consistent across every login path. Require successful verification of the configured second factor before issuing a session, treat passkeys as mandatory when they are the selected factor, and fail closed when factor configuration is incomplete or ambiguous. Reduce password exposure through strong credential practices and phishing-resistant authentication, limit administrative privileges, and apply session invalidation and reauthentication controls for sensitive actions.
Mitigation generally focuses on making authentication policy enforcement consistent across every login path. Require successful verification of the configured second factor before issuing a session, treat passkeys as mandatory when they are the selected factor, and fail closed when factor configuration is incomplete or ambiguous. Reduce password exposure through strong credential practices and phishing-resistant authentication, limit administrative privileges, and apply session invalidation and reauthentication controls for sensitive actions.
How teams detect issues like this
Review authentication handlers for branches that create sessions after password validation without a corresponding factor-specific success signal. Static analysis and code review should look for conditional checks of multifactor flags that do not invoke or enforce WebAuthn verification, as well as fallback paths triggered by absent TOTP configuration. Monitor login events for passkey-enabled accounts authenticated without a WebAuthn assertion, and enforce policy requiring a recorded second-factor result before session issuance. Automated security review tools may help identify inconsistent authentication state handling.
Review authentication handlers for branches that create sessions after password validation without a corresponding factor-specific success signal. Static analysis and code review should look for conditional checks of multifactor flags that do not invoke or enforce WebAuthn verification, as well as fallback paths triggered by absent TOTP configuration. Monitor login events for passkey-enabled accounts authenticated without a WebAuthn assertion, and enforce policy requiring a recorded second-factor result before session issuance. Automated security review tools may help identify inconsistent authentication state handling.
