The primary weakness in Nginx Proxy Manager versions up to 2.16.0 is the absence of rate limiting on key authentication endpoints. The flaw permits any external actor to repeatedly submit login attempts against POST /api/tokens, followed by arbitrary attempts against POST /api/tokens/2fa for two‑factor codes. This pathway allows attackers to eventually acquire full session access and administrative control, posing a severe risk to confidentiality and integrity of the management service.

All releases of Nginx Proxy Manager under the product name Nginx Proxy Manager, specifically versions through 2.16.0, are vulnerable. The affected code resides in the backend application suite, notably the authentication and token generation modules referenced in the source.

The CVSS v3.1 score of 9.1 indicates critical severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger exploitation over any accessible network connection without prior authentication using ordinary HTTP POST requests to the exposed API endpoints. The absence of rate limiting removes barriers to brute‑force attempts, enabling attackers to enumerate credentials and two‑factor codes within realistic timeframes and gain administrative privileges.