Go/github.com/0xJacky/Nginx-UI CVE-2026-107808: high 8.1

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Action: Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074558-95cd21b70814 or later.

go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728074558-95cd21b70814

Affected

Fixed versions

Sources

• osv: GHSA-45gv-9wjv-xh7p
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p
• https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429
• https://github.com/0xJacky/nginx-ui
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

CVE-2026-107808 · published 2026-10-09T17:08:15Z · modified 2026-10-19T21:41:12.332793483Z · JSON