CRITICAL 9.1 NVD
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses agains
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
References
- https://github.com/NginxProxyManager/nginx-proxy-manager
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/app.js#L15-L
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/2fa
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/tok
- https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-09-28 via NVD.
Risk Timeline
CVE Disclosed2026-09-28 · 0 days ago
Remediation Resources
vulnfeed aggregates 13624 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.