NginxProxyManager NGPM <=2.15.1 Auth Bypass via intCert.validate (VRoute)
CVE-2026-93964 Published on September 20, 2026
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Types
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-93964 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2026-93964
Want to know whenever a new CVE is published for Nginxproxymanager Nginx Proxy Manager? stack.watch will email you.
Affected Versions
NginxProxyManager nginx-proxy-manager:- Version 2.0 is affected.
- Version 2.1 is affected.
- Version 2.1.0 is affected.
- Version 2.1.1 is affected.
- Version 2.1.2 is affected.
- Version 2.2 is affected.
- Version 2.2.0 is affected.
- Version 2.2.1 is affected.
- Version 2.2.2 is affected.
- Version 2.2.3 is affected.
- Version 2.2.4 is affected.
- Version 2.3 is affected.
- Version 2.3.0 is affected.
- Version 2.3.1 is affected.
- Version 2.4 is affected.
- Version 2.4.0 is affected.
- Version 2.5 is affected.
- Version 2.5.0 is affected.
- Version 2.6 is affected.
- Version 2.6.0 is affected.
- Version 2.6.1 is affected.
- Version 2.6.2 is affected.
- Version 2.7 is affected.
- Version 2.7.0 is affected.
- Version 2.7.1 is affected.
- Version 2.7.2 is affected.
- Version 2.7.3 is affected.
- Version 2.8 is affected.
- Version 2.8.0 is affected.
- Version 2.8.1 is affected.
- Version 2.9 is affected.
- Version 2.9.0 is affected.
- Version 2.9.1 is affected.
- Version 2.9.2 is affected.
- Version 2.9.3 is affected.
- Version 2.9.4 is affected.
- Version 2.9.5 is affected.
- Version 2.9.6 is affected.
- Version 2.9.7 is affected.
- Version 2.9.8 is affected.
- Version 2.9.9 is affected.
- Version 2.9.10 is affected.
- Version 2.9.11 is affected.
- Version 2.9.12 is affected.
- Version 2.9.13 is affected.
- Version 2.9.14 is affected.
- Version 2.9.15 is affected.
- Version 2.9.16 is affected.
- Version 2.9.17 is affected.
- Version 2.9.18 is affected.
- Version 2.9.19 is affected.
- Version 2.9.20 is affected.
- Version 2.9.21 is affected.
- Version 2.9.22 is affected.
- Version 2.10 is affected.
- Version 2.10.0 is affected.
- Version 2.10.1 is affected.
- Version 2.10.2 is affected.
- Version 2.10.3 is affected.
- Version 2.10.4 is affected.
- Version 2.11 is affected.
- Version 2.12 is affected.
- Version 2.13 is affected.
- Version 2.14.0 is affected.
- Version 2.15.0 is affected.
- Version 2.15.1 is affected.