CVE-2025-50579

Published: Aug 19, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. This misconfiguration enables attackers to intercept tokens using a simple browser script and exfiltrate them to a remote attacker-controlled server, potentially leading to unauthorized actions within the application.

Affected (1)

Products: Jc21: Nginx Proxy Manager

1 product

Nginx Proxy Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jc21 Nginx Proxy Manager	Version 2.12.3

Related CWEs

Improper Restriction of Security Token Assignment

The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

References (2)

https://github.com/NginxProxyManager/nginx-proxy-manager

Source: cve@mitre.org

Product

https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4509

Source: cve@mitre.org

Issue TrackingVendor Advisory

Timeline

No history available yet.