OAuth State Misconfiguration in Nginx UI Web Interface by Nginx

CVE-2026-84312

What is CVE-2026-84312?

The Nginx UI, a web user interface for the Nginx web server, is vulnerable due to a misconfiguration in the OAuth state handling. Specifically, prior to version 2.4.1, the application utilizes the configured Casdoor application name as a fixed OAuth state value. This flaw allows an unauthenticated attacker to trick a victim's browser into completing an OAuth authorization flow controlled by the attacker. Consequently, the callback can create an Nginx UI session based on the identity established by the malicious authorization code, posing a significant risk to user accounts and sensitive data.

References