CVE-2026-84312

Received Received - Intake

Unauthenticated OAuth State Misuse in Nginx UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84312

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Nginx UI before version 2.4.1 has an OAuth state handling flaw. The GetCasdoorUri function uses a static OAuth state value derived from the Casdoor application name, and the CasdoorCallback does not verify if the submitted state matches the session-bound value. This allows an attacker to manipulate the OAuth flow and trick a victim into completing an authorization process controlled by the attacker. As a result, the callback can create a Nginx UI session for the identity returned by the attacker's authorization code.

Detection Guidance

Check Nginx UI version for versions prior to 2.4.1. Inspect OAuth state handling in GetCasdoorUri and CasdoorCallback functions for hardcoded state values. Monitor for unexpected Casdoor authorization flows or callback requests.

Impact Analysis

An unauthenticated attacker could gain unauthorized access to a victim's Nginx UI session by tricking them into completing a malicious OAuth authorization flow. This could lead to session hijacking, unauthorized configuration changes, or exposure of sensitive data managed by Nginx UI.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's access controls. Organizations using affected Nginx UI versions may face compliance violations due to insufficient session validation and authentication controls.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later. Review and update OAuth state generation to use session-bound values. Implement strict state validation in CasdoorCallback. Monitor for unauthorized sessions or authorization attempts.

Hi! I’m here to help you understand CVE-2026-84312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70