CVE-2026-102334: authentication brute-force in Nginx Proxy Manager

Nginx Proxy Manager 2.16.0 vulnerable to authentication brute-force attacks. CVSS 7.4 (high).

CVE-2026-102334 affects Nginx Proxy Manager through version 2.16.0 and describes a vulnerability where authentication endpoints lack rate-limiting and validation enforcement. The flaw allows any unauthenticated attacker to make unlimited password guesses against any account via POST /api/tokens, and subsequently attempt unlimited TOTP code guesses via POST /api/tokens/2fa to gain full session access and administrative control of the platform.

Severity is confirmed by a CVSS score of 7.4 (high), reflecting direct impact on authentication and administrative control. The vulnerability was published in NVD on September 28, 2026. A consistent signal comes from public GitHub repositories that declare they contain exploit code for CVE-2026-102334, first reported on November 5, 2026: this indicates the flaw has been actively analyzed and working exploit code is now publicly tracked.

Nginx Proxy Manager administrators must prioritize applying available security patches immediately. In the interim, implement network protection on /api/tokens and /api/tokens/2fa endpoints (via WAF or load balancer-level throttling), monitor logs for suspicious sequences of failed authentication attempts, and restrict access to management endpoints to trusted corporate IP addresses only. Review access logs for evidence of past brute-force activity.

At a glance

What: CVE-2026-102334 affects Nginx Proxy Manager through 2.16.0. The vulnerability is the absence of rate-limiting on authentication endpoints /api/tokens (password brute-force) and /api/tokens/2fa (TOTP brute-force). It allows any unauthenticated attacker unlimited guessing attempts to gain full session access and administrative control.
Severity: CVSS 7.4 (high). Direct impact on authentication and administrative access. No authentication required for the attack.
Affected versions: Nginx Proxy Manager through 2.16.0 (all versions up to and including this release).
Fix: Not reported in the available official data
Status: Published in NVD on September 28, 2026. Public exploit tracked on GitHub repositories as of November 5, 2026. Vulnerability actively analyzed.
Action: Apply security patches as soon as available. Implement rate-limiting at network level on /api/tokens and /api/tokens/2fa endpoints (WAF, load balancer). Monitor logs for suspicious sequences of failed authentication attempts. Restrict access to management endpoints to trusted corporate IP addresses only. Review access logs for evidence of past brute-force activity.

Sources: NVD, CVE-2026-102334

← All articles