CyberRota Analysis
AI-GeneratedNginx Proxy Manager versions up to 2.16.0 are vulnerable due to the absence of rate-limiting on authentication endpoints, enabling unauthenticated attackers to perform unlimited password guessing attempts. This flaw allows attackers to brute-force login credentials and subsequently bypass two-factor authentication, potentially leading to full administrative access. Organizations using Nginx Proxy Manager should prioritize patching this vulnerability to safeguard against unauthorized access and potential compromise of their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.