Nginx UI CVE-2026-84315

Exploitation requires the attacker to already possess a valid authenticated Nginx UI session (PR:L) belonging to an OTP-enabled user, and targets the specific mutation routes that were missing the RequireSecureSession middleware: backup creation (GET /backup) and automatic-backup management (POST /auto_backup, POST/DELETE/PATCH /auto_backup/:id, POST /auto_backup/test_s3), plus the described DNS credential/record, certificate, ACME user, Nginx control, and site/stream automation endpoints. The limiting factor is that this is a step-up (OTP/passkey) bypass, not an authentication bypass - the normal session login is still required; the flaw only removes the fresh X-Secure-Session-ID re-verification expected for sensitive actions. Only versions prior to 2.4.1 are affected, and the condition specifically involves OTP-enabled accounts for which the secure-session step-up was supposed to apply.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, base 8.3) indicates a low-complexity, network-reachable flaw requiring low privileges (PR:L) and no user interaction, with high integrity and availability impact - consistent with the description of an authorization/step-up bypass on sensitive mutation routes (CWE-862). This is a privilege/authorization control failure rather than a full pre-auth RCE: the attacker must already hold a valid authenticated session, which is why PR is Low, not None. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only exploitation artifact is the vendor fix commit itself, which confirms the defect but is not an attack tool. Net: this is a genuine security hardening gap that elevates the impact of any session compromise, but its real-world priority is moderated by the precondition of an already-stolen authenticated session and the absence of any exploitation-probability or active-exploitation signals - treat as a solid-priority patch for exposed Nginx UI instances rather than an emergency mass-exploitation event.

An attacker who obtains a valid authenticated Nginx UI session for an OTP-enabled user (e.g. via a stolen JWT, XSS, or session hijacking) replays that session against sensitive mutation endpoints such as /auto_backup or backup creation. Because RequireSecureSession is not enforced on those routes, the attacker performs high-impact changes - creating/altering automatic backups, DNS credentials and records, certificates, ACME users, and Nginx control settings - without ever completing the OTP or passkey step-up. No public POC was identified, though the fix commit (23d1934) clearly documents the vulnerable routes.