Nginx-UI from version 2.0.0 up to 2.5.0 accepted a browser‑managed token cookie as an API credential after storing the JWT in that cookie. The management endpoints did not enforce a CSRF token or validate Origin or Referer headers. Consequently, a remote attacker can craft a site that forces a logged‑in administrator’s browser to submit authenticated cross‑site state‑changing requests such as POST /api/configs. The attacker cannot read the cross‑origin response but can modify Nginx configuration, trigger reloads, or invoke other privileged operations that execute under the victim’s session. The flaw is a classic CSRF vulnerability (CWE‑352) that grants unauthorized configuration control.

The affected product is Nginx‑UI (0xJacky) with versions starting at 2.0.0 and ending at 2.5.0, inclusive. Version 2.5.0 includes the fix that removes the token cookie fallback for AuthRequired.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but the attack requires only a remote address and an administrative account that lacks OTP or Passkey authentication. The exploitation potential is significant for environments where administrators do not use multi‑factor authentication, as an attacker can modify critical server configuration without detection. The remote nature of the attack and the lack of defensive checks make it relatively easy to exploit in practice.