CVE-2025-50579 Misconfiguration in n/a

Medium 5.3 Published 19 Aug 2025 Updated 19 Aug 2025

Attackers can steal JWT tokens via CORS misconfiguration in Nginx Proxy Manager, enabling unauthorized access and data exfiltration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-50579?

CVE-2025-50579 is a medium-severity vulnerability in n/a, published on 19 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. This misconfiguration enables attackers to intercept tokens using a simple browser script and exfiltrate them to a remote attacker-controlled server, potentially leading to unauthorized actions within the application.

Weakness: CWE-1259

Which versions are affected by CVE-2025-50579?

It affects 1 product.

Products include Jc21 Nginx Proxy Manager.

How do I fix CVE-2025-50579?

No fix has been published for CVE-2025-50579 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-50579 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-50579 exists.

Sources

Also known as GHSA-h493-5cp7-m669.