What is CVE-2026-107804?

CVE-2026-107804 is a medium-severity vulnerability in 0xjacky Nginx-Ui, classified under Origin Validation Error. CVSS score: 5.3/10. Published 2026-10-09.

How severe is CVE-2026-107804?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in 0xjacky Nginx-Ui

CVE-2026-107804

Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.

Published 2026-10-09 · last modified 2026-10-09.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

0xjacky Nginx-Ui — versions >= 2.2.0, < 2.6.0

Weakness classification (CWE)

CWE-346 — Origin Validation Error

References

Frequently asked questions

What is CVE-2026-107804?: CVE-2026-107804 is a medium-severity vulnerability in 0xjacky Nginx-Ui, classified under Origin Validation Error. CVSS score: 5.3/10. Published 2026-10-09.
How severe is CVE-2026-107804?: Medium severity. CVSS v3 base score is 5.3 out of 10.