{"id":"EUVD-2026-97864","enisaUuid":"1b845f82-6e2e-3bf1-9bad-12eef2ce3a09","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:49:36 PM","dateUpdated":"Oct 13, 2026, 3:50:29 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wq4w-vwvq-q3x9\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84321\nGHSA-wq4w-vwvq-q3x9\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"32fafff7-0077-3d8a-bf14-7f80ddbfeed6","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"enisaIdVendor":[{"id":"50ed518b-2966-3889-bb92-4e9cfbbd330c","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"049ebfa1-02f4-3ddd-bda7-38688a70883d","vulnerability":{"id":"GHSA-wq4w-vwvq-q3x9","description":"Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable","datePublished":"Oct 15, 2026, 8:14:01 PM","dateUpdated":"Oct 15, 2026, 8:14:01 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wq4w-vwvq-q3x9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84321\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97864\n","aliases":"CVE-2026-84321\nGHSA-wq4w-vwvq-q3x9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a36114dc-9c52-3969-917d-d5eb677eac83","vulnerability":{"id":"CVE-2026-84321","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:49:36 PM","dateUpdated":"Oct 13, 2026, 3:50:29 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wq4w-vwvq-q3x9\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97864\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:13:27 AM","vulnerabilityProduct":[{"id":"937efe2c-e360-35a3-ab1e-ac927c836ec4","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"fcbea036-5992-38fa-acd1-581404a6829c","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}