Nginx UI versions 2.0.0 through 2.5.0 incorrectly allow the master credential to be transmitted via the node_secret query parameter in HTTP and WebSocket authentication paths instead of the intended X-Node-Secret header. This flaw exposes the credential in logs, browser history, Referer headers, configuration URLs, and deployment environment data, making it trivially visible to anyone with access to those logs or to the network traffic. An attacker who obtains the secret can bypass password, JWT, session, and second‑factor checks, and gain persistent administrative API access, including the ability to read and modify configuration and secret material. The weakness is categorized as CWE‑312 (Cleartext Storage of Sensitive Information) and CWE‑598 (Information Exposure Through Log Files).

The affected vendor is 0xJacky with the product Nginx UI. All releases from version 2.0.0 up to and including 2.5.0 are vulnerable; the issue was fixed in version 2.5.0.

With a CVSS score of 8.8 the vulnerability is considered high risk. The EPSS score is not available; it is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker leveraging a crafted URL containing the node_secret parameter. An attacker can retrieve the secret from any server or client that logs the URL or examines request traffic, and then use the permanent credential to gain administrative control without further authentication.