CVE-2026-102334
HighCVSS 7.4Summary
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
Risk Assessment
The lack of rate-limiting enables attackers to perform brute-force attacks on passwords and 2FA codes, potentially resulting in full administrative account takeover and system control.
Recommendation
Upgrade Nginx Proxy Manager beyond 2.16.0 if available and implement rate-limiting on authentication endpoints. Consider additional protections such as account lockout after failed login attempts.
Other vulnerabilities in Nginx Proxy Manager
See all- CVE-2026-102335High
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
- CVE-2026-50892Medium
In Nginx Proxy Manager v2.14.0, incorrect access control in the 'Let's Encrypt' certificate download endpoint allows authenticated attackers to obtain TLS private key material via a crafted GET request.
- CVE-2026-40519High
Nginx Proxy Manager versions 2.9.14 through 2.15.1 contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function. Attackers with certificates:manage permission can store a malicious payload in the dns_provider_credentials field, which is directly interpolated into a shell command without sanitization, leading to arbitrary command execution upon backend restart.
Original NVD description (English source)
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS