Brute Force Vulnerability in Nginx Proxy Manager by Nginx

CVE-2026-102334

What is CVE-2026-102334?

Nginx Proxy Manager version 2.16.0 is susceptible to a brute force vulnerability due to the absence of rate-limiting on its authentication endpoints. This flaw allows unauthenticated attackers to continuously attempt to guess passwords without restriction. By exploiting the POST /api/tokens endpoint, attackers can brute-force login credentials and further exploit the POST /api/tokens/2fa endpoint to guess time-based one-time passwords (TOTP). Successful exploitation grants attackers full session access and administrative control, posing significant security risks.

References