CVE-2026-84315: Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI has a short-lived OTP/passkey “secure session” step-up boundary for users with 2FA enabled. RequireSecureSession() rejects an OTP-enabled user’s request unless the request includes a valid X-Secure-Session-ID issued after a fresh OTP/passkey verification.

The project already applies this step-up middleware to sensitive operations such as:

• Nginx config create/edit/rename/delete;
• site save/delete/enable/disable/rename/duplicate;
• stream save/delete/enable/disable/rename/duplicate;
• settings save and protected secret reads;
• backup restore.

However, several similarly sensitive authenticated mutation routes remain outside RequireSecureSession(). An attacker who obtains an authenticated JWT/session for a 2FA-enabled user, but does not have the victim’s fresh OTP/passkey secure-session token, can still perform those operations.

The affected route groups include:

• automatic backup create/modify/delete/restore/test-S3 operations;
• DNS credential create/edit/delete operations;
• certificate and ACME user create/modify/delete/register operations;
• DNS domain, record, and DDNS create/update/delete operations;
• Nginx reload/restart, stub-status toggle, performance-setting update, and module-cache refresh operations;
• site/stream advanced-mode toggles and batch updates;
• auto-certificate binding/unbinding for sites;
• site navigation order and health-check updates.

This report is distinct from my earlier Nginx UI report about auto-backup path traversal. This report is about missing 2FA step-up authorization on sensitive authenticated mutation routes.