ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-84312

Nginx UI is a web user interface for the Nginx web server.

Published Oct 12, 2026 · catalog updated Oct 15, 2026 · Nginx UI is a

Check if you run it

No confirmed exploitation is on record for CVE-2026-84312. EPSS is 0.18%. Act only if a listed version of Nginx UI is a is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Nginx UI is a).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.18%
Remediation
Advisory link
Affected products
Go Nginx-UI

## Summary In the Casdoor SSO flow, the OAuth parameter is hard-coded to — a value identical for every user and every login. The callback handler accepts whatever the client sends without comparing it to anything stored in the user agent, enabling a login-CSRF: an attacker can force the victim's browser to authenticate as the *attacker*. ## Details ( ): ( ): Compare with the OIDC implementation in , which generates a random state, stores it in an cookie, and validates it on the callback. Casdoor has no such check. ## Proof of Concept 1. Attacker initiates a Casdoor authorisation flow on their own browser, obtaining an authorisation for *their* Casdoor account. 2. Attacker hosts a page that auto-submits the captured to the victim's nginx-ui: 3. Server exchanges the attacker's , looks up the username from in the local user table, and mints a JWT for *that* row. The callback also sets the cookie via ( ) — meaning the victim is now silently authenticated as the attacker. 4. Victim, believing they are using their own account, configures sites / TLS keys; the attacker reads them. ## Impact Login CSRF — the victim is forced to authenticate as the attacker, leading to data exfiltration of anything the victim subsequently uploads or configures. Particularly dangerous when nginx-ui is used by an organisation where Casdoor maps internal identities — the attacker can attribute their changes to the victim. ## Patches Mirror the OIDC implementation: ## Workarounds Disable Casdoor SSO until patched. The OIDC integration in is correctly implemented and can be used as a substitute. ## References * [ ](https://github.com/0xJacky/nginx-ui/blob/dev/api/user/casdoor.go#L92-L117) * [ ](https://github.com/0xJacky/nginx-ui/blob/dev/api/user/casdoor.go#L24-L90) * [ ](https://github.com/0xJacky/nginx-ui/blob/dev/api/user/oidc.go#L35-L48) (correct implementation for comparison) ## Credits Vishal Shukla ([@shukla304](https://github.com/shukla304)) and Sechub.dev AI Agent.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go Nginx-UIversion unspecified

How to fix CVE-2026-84312

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-84312. EPSS is 0.18%. Act only if a listed version of Nginx UI is a is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-287: Improper Authentication; CWE-352: Cross-Site Request Forgery (CSRF). EPSS 0.18%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nginx security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and

  2. Oct 14, 2026 · NIST NVD

    Updated

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and

  3. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary In the Casdoor SSO flow, the OAuth parameter is hard-coded to — a value identical for every user and every login. The callback handler accepts whatever the client sends without comparing it to anything stored in the user agent, enabling a login-CSRF: an attacker can force the victim's browser to authenticate as the *attacker*. ## Details ( ): ( ): Compare with the OIDC implementation in

Sources

  • CVE.orgVulnerability recordCVE-2026-84312

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-84312

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-44xr-mrhh-qm78

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-84312

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-44xr-mrhh-qm78

    Nginx UI: Casdoor SSO callback uses a constant parameter (login CSRF)

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.