The vulnerability arises because Nginx UI does not enforce the RequireSecureSession check on several authenticated mutation routes even when OTP is enabled. As a result, a compromised authenticated session can perform sensitive changes—such as creating or altering backup jobs, DNS credential records, SSL certificates, ACME user accounts, and Nginx configuration—without completing the OTP or passkey step-up. This leads to a breach of confidentiality and integrity for the affected managed resources.

The issue applies to the 0xJacky Nginx UI web interface for the Nginx web server. All releases before version 2.4.1 are affected because they lack the necessary secure‑session enforcement for the highlighted routes.

The CVSS score of 8.3 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of an OTP requirement presents a straightforward exploitation path for attackers who can hijack an authenticated session or inject a session cookie. Based on the description, the likely attack vector is remote via HTTP, requiring only an existing authenticated session to achieve full control over the critical configuration endpoints.