EUVD-2026-88567
GHSA-pm9h-p429-j8c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote and unauthenticated (AV:N/PR:N/UI:N); AC:H because success depends on guessable credentials and, when enabled, a rotating TOTP; full admin takeover gives C:H/I:H, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
Articles & Coverage 2
AnalysisAI
Missing rate limiting on the authentication API of Nginx Proxy Manager through 2.16.0 allows unauthenticated remote attackers to submit unlimited password guesses to POST /api/tokens and then unlimited TOTP guesses to POST /api/tokens/2fa, ultimately obtaining a valid session and full administrative control of the instance. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, but the weakness is directly reachable by anyone who can talk to the admin interface, which is commonly internet-exposed on self-hosted deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected feature is the authentication API of Nginx Proxy Manager (POST /api/tokens for login and POST /api/tokens/2fa for TOTP), which through version 2.16.0 ships with no rate-limiting, throttling, or account lockout. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-value weakness in a widely self-hosted product, but the raw 9.1 vendor score overstates the practical certainty of exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the vendor-supplied remediation is pull request https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908, which introduces a rate-limiting middleware at backend/lib/express/rate-limit.js for the authentication routes, so the durable fix is to upgrade to the first Nginx Proxy Manager release that ships this PR once it is tagged (input data says patch available from vendor, but no exact fixed version number is published). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, apply the vendor patch per advisory (upgrade beyond version 2.16.0) and restrict administrative interface access to trusted networks via firewall rules or VPN. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Share
External POC / Exploit Code
Leaving vuln.today