Nginx UI, a web interface for the Nginx server, has a flaw in the way it handles one‑time‑password (OTP) secure sessions. When a user has a valid OTP but does not set the X‑Secure‑Session‑ID header, the /mcp and /mcp_message endpoints allow access to nginx_config_add and nginx_config_modify, bypassing the expected RequireSecureSession guard that protects configuration mutation routes. Because the OTP authentication is present but step‑up control is not enforced, an attacker who can obtain OTP‑enabled credentials may alter or add Nginx configuration directives, potentially causing service disruption or enabling further compromise.

The affected product is nginx‑ui from the vendor 0xJacky. All releases prior to version 2.4.1 are impacted; the fix is present in version 2.4.1 and later.

The CVSS score of 8.1 reflects a high‑severity vulnerability that can lead to unauthorized changes to server configuration. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves a web‑based request to /mcp or /mcp_message using a valid OTP‑enabled session without the required secure‑session header. If an attacker can obtain OTP credentials, exploitation requires only web access and can be performed remotely.