CVE-2026-84312: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Vulnerability summary
CVE-2026-84312 is a high (CVSS 7.1) Improper Authentication vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.6% of scored vulnerabilities.
Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 12-10-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- OSV · GoEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-352Cross-Site Request ForgeryThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
0xjacky1 product
- nginx-ui< 2.4.1
Github.com/0xJacky1 product
- Nginx-UIAll versions (No fix recorded) | < 1.9.10-0.20260703131214-23d1934099b0
Go1 product
- Nginx-UIAll versions (No fix recorded)
3 vendors · 3 products
References
5 links
- github.com/0xJacky/nginx-uiPACKAGE