GO-2026-6786

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6786

Import Source

https://vuln.go.dev/ID/GO-2026-6786.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6786

Aliases

Published

2026-10-19T21:08:39Z

Modified

2026-10-19T21:31:50Z

Summary

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

Details

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

Database specific

{
    "review_status":  "REVIEWED",
    "url":  "https://pkg.go.dev/vuln/GO-2026-6786"
}

References

Affected packages

Go / github.com/0xJacky/Nginx-UI

Package

Name: github.com/0xJacky/Nginx-UI; View open source insights on deps.dev
Purl: pkg:golang/github.com/0xJacky/Nginx-UI

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "custom_ranges":  [
        {
            "events":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.9.10-0.20260703131214-23d1934099b0"
                }
            ],
            "type":  "ECOSYSTEM"
        }
    ],
    "imports":  [
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/nginx",
            "symbols":  [
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/streams",
            "symbols":  [
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/internal/backup",
            "symbols":  [
                "ValidateAutoBackupConfig",
                "createCustomDirectoryBackup",
                "createEncryptedBackup"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/terminal",
            "symbols":  [
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/mcp",
            "symbols":  [
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/internal/middleware",
            "symbols":  [
                "RequireSecureSession"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/sites",
            "symbols":  [
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/certificate",
            "symbols":  [
                "InitAcmeUserRouter",
                "InitCertificateRouter",
                "InitCertificateWebSocketRouter",
                "InitDNSCredentialRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/internal/config",
            "symbols":  [
                "ValidateConfigDirectives",
                "configuresRootWorkers",
                "firstDirectiveToken",
                "loadsRestrictedDynamicModule"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/mcp/config",
            "symbols":  [
                "handleNginxConfigAdd"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/settings",
            "symbols":  [
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/internal/user",
            "symbols":  [
                "DeleteToken",
                "DeleteUserTokens",
                "GetTokenUserByShortToken"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/backup",
            "symbols":  [
                "InitAutoBackupRouter",
                "InitRouter"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/user",
            "symbols":  [
                "BeginPasskeyRegistration",
                "CasdoorCallback",
                "EnrollTOTP",
                "GetCasdoorUri",
                "InitManageUserRouter",
                "InitUserRouter",
                "UpdateCurrentUserPassword"
            ]
        },
        {
            "path":  "github.com/0xJacky/Nginx-UI/api/dns",
            "symbols":  [
                "InitRouter"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6786.json"