CVE-2026-84312 · GHSA-44xr-mrhh-qm78
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
- Risk score
- 64/100
- CVSS
- 7.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a vi…
- Affected
- Nginx-UI (go) < 1.9.10-0.20260703131214-23d1934099b0
- Fix
- No patched version listed yet: check the advisory for mitigations.
- Exploitation
- Public proof of concept
Story map
At a glance
Nginx-UI: Amber, patch this week. Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controll…
The flaws
- CVE-2026-84312: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) (CVSS 7.1 · EPSS 0%)
- CVE-2026-84313: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover (CVSS 8.8 · EPSS 0%)
The fix
Upgrade Nginx-UI: 2.4.1 or later on your release line
Who is exposed: Nginx-UI (go) < 1.9.10-0.20260703131214-23d1934099b0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Authentication bypass (CWE-287). 236 other warnings in 30 days
Why it is Amber
- CVSS 7.1 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: nginx, Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| Nginx-UI | go | < 1.9.10-0.20260703131214-23d1934099b0 | No fix yet |
References
- https://github.com/advisories/GHSA-44xr-mrhh-qm78
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78
- https://nvd.nist.gov/vuln/detail/CVE-2026-84312
- https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
- https://github.com/advisories/GHSA-44xr-mrhh-qm78
Original description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.
Last activity 12 Oct 2026. Patch Forecast updates every hour.