EUVD-2026-54516
GHSA-jffj-qrgg-8qm5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, no complexity beyond holding nexus:* permission (PR:H), integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
2DescriptionCVE.org
Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.
AnalysisAI
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Technical ContextAI
Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*) is Sonatype's artifact repository manager widely used in enterprise DevOps pipelines for Maven, npm, Docker, and other package ecosystems. The vulnerability maps to CWE-620 (Unverified Password Change), which describes a failure to authenticate the actor requesting a password change or to verify that the change is occurring in the intended application state. The root cause is an endpoint designed exclusively for the initial onboarding wizard that uses file-system artifact presence as its authorization gate rather than enforcing a proper state machine. Because the onboarding artifact can persist after setup completes, any account already holding the nexus:* wildcard permission - which grants broad repository management rights - can invoke the endpoint outside the intended onboarding context. The additional omission of session invalidation after the password change means active administrator sessions remain open, creating a window where two parties simultaneously hold effective admin control.
RemediationAI
The primary fix is to upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, as documented in the release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html and the vendor advisory at https://support.sonatype.com/hc/en-us/articles/53884654627475/. If immediate upgrade is not feasible, operators should audit and aggressively restrict which accounts hold the nexus:* wildcard permission, replacing it with narrower scoped permissions wherever possible - this reduces the population of accounts capable of triggering the vulnerability. Additionally, reviewing audit logs for unexpected calls to the onboarding password-change endpoint can serve as a detective control. Operators should also manually remove or rename the local onboarding artifact if it persists after initial setup, as its presence is the server-side condition the endpoint relies on; however, this compensating control should be treated as temporary since its effect depends on artifact naming and location, which may vary by version. After any suspected exploitation event, all administrator and privileged sessions should be invalidated and credentials rotated.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - hold
Same weakness CWE-620 – Unverified Password Change
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today