{"id":"EUVD-2026-97963","enisaUuid":"413d35b5-7e6a-3fa3-b475-f040b4b9b4a2","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim\u0027s browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 9:16:56 PM","dateUpdated":"Oct 14, 2026, 11:36:49 AM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84312\nGHSA-44xr-mrhh-qm78\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"9d592e1e-c342-3381-bc9e-b24ef02d3e47","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"enisaIdVendor":[{"id":"b87331f0-81d5-32af-988f-151f97fba0ad","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"3b317f23-628f-337b-a3af-fb85e650a143","vulnerability":{"id":"CVE-2026-84312","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim\u0027s browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 9:16:56 PM","dateUpdated":"Oct 14, 2026, 11:36:49 AM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97963\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Oct 28, 2026, 7:13:00 AM","vulnerabilityProduct":[{"id":"07b4970a-b98f-358c-a5d8-cdf4fa6cb6d7","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"46f27eaf-2365-3750-8970-ba0a39c4bae3","vendor":{"name":"0xJacky"}}]}},{"id":"6fb5c64e-e59a-3b87-9a3f-1717a7b4dc26","vulnerability":{"id":"GHSA-44xr-mrhh-qm78","description":"Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)","datePublished":"Oct 15, 2026, 8:12:52 PM","dateUpdated":"Oct 15, 2026, 8:12:52 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84312\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97963\n","aliases":"CVE-2026-84312\nGHSA-44xr-mrhh-qm78\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}