CVE-2026-84321 Details
Description
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.
A vulnerability in Nginx UI prior to version 2.4.1 allows standalone short tokens to survive revocation and be reused, potentially restoring access to authenticated routes. This occurs because the token deletion process does not clear all cached entries, leaving revoked tokens valid until the cache expires. If the associated user account is re-enabled before the cache entry expires, the short token can be used again, bypassing the intended revocation.
Users can update to Nginx UI version 2.4.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2 | [email protected] | Source CodeVendor |
| https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1 | [email protected] | Release NotesVendor |
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wq4w-vwvq-q3x9 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 0xJacky Nginx UI | <= 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |