CVE-2026-102334CWE-307

CVE-2026-102334

High · published September 29, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00453 · 38.4th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-09-29T03:17Z
References (6)
https://github.com/NginxProxyManager/nginx-proxy-manager · [email protected]https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/app.js#L15-L58 · [email protected]https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/2fa.js#L196-L240 · [email protected]https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/token.js#L154-L182 · [email protected]https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908 · [email protected]https://www.vulncheck.com/advisories/nginx-proxy-manager-through-2.16.0-missing-brute-force-protection · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 22:21Z
    Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
    cvelistv5