Vulnerability · Published Sep 28, 2026 · Assigned by VulnCheck

CVE-2026-102334Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

High 7.4

In plain English

A high-severity security flaw in nginx-proxy-manager from NginxProxyManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.

Affected products (as reported)

Vendor	Product	Versions
NginxProxyManager	nginx-proxy-manager	0 – through 2.16.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908 patch, issue-tracking
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/app.js#L15-L58 technical-description
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/token.js#L154-L182 technical-description
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/2fa.js#L196-L240 technical-description
https://github.com/NginxProxyManager/nginx-proxy-manager product
VulnCheck Advisory: Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection third-party-advisory