Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-102334: Nginx Proxy Manager allows unlimited login guesses

CVE-2026-102334 · published 3 days ago

Summary

The Nginx Proxy Manager version 2.16.0 and earlier does not limit how often someone can try to log in, so an attacker can repeatedly guess passwords and verification codes. This could let an unauthorized person obtain full administrative access. Upgrade to a newer version that includes rate‑limiting or add external protections such as firewalls or login throttling, and use strong, unique passwords with two‑factor authentication.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
nginxproxymanager	nginx-proxy-manager	<= 2.16.0

Original advisory text

Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1023... Vendor Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager Product
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/ap... Third Party Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/in... Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102334 Vendor Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/in... Third Party Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908 Patch
https://www.vulncheck.com/advisories/nginx-proxy-manager-through-2.16.0-missing-... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-307Improper Restriction of Excessive Authentication Attempts

Timeline

Published28 Sep 2026

Updated1 Oct 2026

First seen28 Sep 2026

Sources

CVE-2026-102334 · NVD

CVE-2026-102334 · MITRE

CVE-2026-102334 · OSV

Track software like this

Free during beta