Nginx UI, a web interface for the Nginx web server, performs login requests via POST /api/login. Between releases 2.0.0 and 2.4.x, the endpoint checks whether two‑factor authentication is enabled but does not require a WebAuthn assertion when a passkey‑only account (EnabledPasskey true) is used and no TOTP secret is configured. Consequently, after the password is verified, the system issues a session even though the user is reported to have a second factor. An adversary who obtains the account password can therefore take over that account and access administrative features without presenting the registered passkey. This authentication bypass is a direct consequence of the missing enforcement of the second factor and matches CWE‑287, CWE‑305, and CWE‑308.

The product affected by this vulnerability is the nginx‑ui application distributed by 0xJacky. All releases from version 2.0.0 up to, but not including, 2.5.0 are vulnerable. Users running any of these versions should identify whether their installation allows passkey‑only accounts and whether TOTP was configured for those accounts. Administrators should verify that the configuration file does not expose accounts that depend solely on a passkey for two‑factor authentication.

The CVSS base score for this issue is 8.1, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to gain or guess the password of a user account that has EnabledPasskey true but lacks a TOTP secret; no additional software or privileged access is needed. Once authenticated, the attacker can perform any administrative operation that the compromised account is authorised to do. The combination of a high score and the straightforward remote execution path makes this a critical issue for environments relying on nginx‑ui for management.