CVE-2026-93964

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/NginxProxyManager/nginx-proxy-manager/
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5594
https://vuldb.com/cve/CVE-2026-93964
https://vuldb.com/submit/944336
https://vuldb.com/vuln/407923
https://vuldb.com/vuln/407923/cti

Configurations

No configuration.

History

20 Sep 2026, 06:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-20 06:16

Updated : 2026-09-22 16:18

NVD link : CVE-2026-93964

Mitre link : CVE-2026-93964

CVE.ORG link : CVE-2026-93964

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-93964", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93964", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T15:34:02.996167Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:nginxproxymanager:nginx-proxy-manager:*:*:*:*:*:*:*:*"], "vendor": "NginxProxyManager", "modules": ["Validate Route"], "product": "nginx-proxy-manager", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.1.1"}, {"status": "affected", "version": "2.1.2"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.3.0"}, {"status": "affected", "version": "2.3.1"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.4.0"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.5.0"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.6.1"}, {"status": "affected", "version": "2.6.2"}, {"status": "affected", "version": "2.7"}, {"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.1"}, {"status": "affected", "version": "2.7.2"}, {"status": "affected", "version": "2.7.3"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.8.0"}, {"status": "affected", "version": "2.8.1"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.9.0"}, {"status": "affected", "version": "2.9.1"}, {"status": "affected", "version": "2.9.2"}, {"status": "affected", "version": "2.9.3"}, {"status": "affected", "version": "2.9.4"}, {"status": "affected", "version": "2.9.5"}, {"status": "affected", "version": "2.9.6"}, {"status": "affected", "version": "2.9.7"}, {"status": "affected", "version": "2.9.8"}, {"status": "affected", "version": "2.9.9"}, {"status": "affected", "version": "2.9.10"}, {"status": "affected", "version": "2.9.11"}, {"status": "affected", "version": "2.9.12"}, {"status": "affected", "version": "2.9.13"}, {"status": "affected", "version": "2.9.14"}, {"status": "affected", "version": "2.9.15"}, {"status": "affected", "version": "2.9.16"}, {"status": "affected", "version": "2.9.17"}, {"status": "affected", "version": "2.9.18"}, {"status": "affected", "version": "2.9.19"}, {"status": "affected", "version": "2.9.20"}, {"status": "affected", "version": "2.9.21"}, {"status": "affected", "version": "2.9.22"}, {"status": "affected", "version": "2.10"}, {"status": "affected", "version": "2.10.0"}, {"status": "affected", "version": "2.10.1"}, {"status": "affected", "version": "2.10.2"}, {"status": "affected", "version": "2.10.3"}, {"status": "affected", "version": "2.10.4"}, {"status": "affected", "version": "2.11"}, {"status": "affected", "version": "2.12"}, {"status": "affected", "version": "2.13"}, {"status": "affected", "version": "2.14.0"}, {"status": "affected", "version": "2.15.0"}, {"status": "affected", "version": "2.15.1"}]}]}], "published": "2026-09-20T06:16:50.477", "references": [{"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/", "source": "cna@vuldb.com"}, {"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5594", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-93964", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/944336", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/407923", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/407923/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet."}], "lastModified": "2026-09-22T16:18:14.893", "sourceIdentifier": "cna@vuldb.com"}