CVE-2025-50579

5.3 mediumEPSS 0.4%

Medium (5.3) in jc21 nginx proxy manager. EPSS 0.4% chance of exploitation in the next 30 days.

A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. This misconfiguration enables attackers to intercept tokens using a simple browser script and exfiltrate them to a remote attacker-controlled server, potentially leading to unauthorized actions within the application.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-1259
Published: 2025-08-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jc21:nginx_proxy_manager

References

https://github.com/NginxProxyManager/nginx-proxy-manager
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4509

Check your stack JSON