CVE-2026-84312: Nginx UI OAuth Authentication Bypass

CVE-2026-84312 Overview

CVE-2026-84312 is an authentication bypass vulnerability in Nginx UI, a web user interface for the Nginx web server. Versions prior to 2.4.1 use the configured Casdoor application name as a constant OAuth state value. The CasdoorCallback handler does not compare the submitted state parameter against a value bound to the initiating browser session. An unauthenticated attacker can coerce a victim's browser to complete an attacker-controlled Casdoor authorization flow. The callback then mints a Nginx UI session for the identity returned by that authorization code, granting the attacker access as the victim. The issue is resolved in Nginx UI version 2.4.1 and is tracked under [CWE-287: Improper Authentication].

Critical Impact
An unauthenticated attacker can hijack a victim's Nginx UI session via a cross-site request forgery against the Casdoor OAuth callback, resulting in full account takeover.

Affected Products

Nginx UI versions prior to 2.4.1
Deployments integrated with Casdoor single sign-on
Nginx UI instances exposed to untrusted networks or users

Discovery Timeline

2026-10-12 - CVE CVE-2026-84312 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-84312

Vulnerability Analysis

The vulnerability resides in the OAuth 2.0 authorization code flow between Nginx UI and Casdoor. The GetCasdoorUri function builds the authorization request URL using the configured Casdoor application name as the OAuth state parameter. Because this value is static and derived from server configuration, it is identical for every user and every authentication attempt. The CasdoorCallback handler accepts the callback without binding the received state to the browser session that initiated the flow.

An attacker can obtain an authorization code bound to an attacker-controlled Casdoor identity and craft a callback URL. If a victim with a valid Nginx UI session visits the attacker's URL, Nginx UI processes the callback and issues a session cookie for the identity in the authorization code. The attack succeeds without any prior access to the Nginx UI instance.

Root Cause

The root cause is the absence of a per-session, unpredictable state nonce. OAuth 2.0 requires that the state value be unguessable, unique per authorization request, and bound to the user agent that initiated the flow. Nginx UI violated all three requirements by reusing a constant, configuration-derived string.

Attack Vector

Exploitation is network-based and requires user interaction, typically through phishing or a malicious page that triggers navigation to the crafted callback URL. The attacker does not need credentials for Nginx UI. The result is confidentiality compromise and limited integrity impact against the victim's session.

// Patch excerpt from api/backup/router.go
// Source: https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
func InitRouter(r *gin.RouterGroup) {
-	r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+	r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
 	r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)
}

The companion change in api/certificate/router.go wraps sensitive certificate and DNS credential routes with middleware.RequireSecureSession(), hardening administrative paths that would be reachable after session hijack. See the GitHub commit log for the full fix.

Detection Methods for CVE-2026-84312

Indicators of Compromise

Casdoor OAuth callback requests to /api/casdoor_callback where the state parameter equals the configured Casdoor application name across different source IPs or sessions.
Successful Nginx UI logins immediately following a callback from an external referrer not associated with normal user navigation.
Session cookies issued to source IPs that do not match the user's historical login geolocation or ASN.

Detection Strategies

Correlate Casdoor authorization server logs with Nginx UI session issuance to identify authorization codes consumed by browsers that did not initiate the flow.
Alert on repeated callback invocations carrying the same static state value from multiple user agents.
Monitor Nginx UI admin actions, particularly backup creation, certificate changes, and DNS credential writes, performed shortly after login.

Monitoring Recommendations

Forward Nginx UI access logs and Casdoor audit logs to a centralized SIEM for cross-source correlation.
Baseline normal OAuth callback volume per account and alert on deviations.
Track administrative route activity on /api/backup, /api/certs, and /api/dns_credentials for unexpected callers.

How to Mitigate CVE-2026-84312

Immediate Actions Required

Upgrade Nginx UI to version 2.4.1 or later without delay.
Invalidate all active Nginx UI sessions and force reauthentication after upgrading.
Rotate Casdoor client secrets and review Casdoor application configuration for unauthorized redirect URIs.
Audit administrative actions performed since the deployment of the vulnerable release.

Patch Information

The fix is included in Nginx UI 2.4.1. Review the GitHub Release v2.4.1, the GitHub Security Advisory GHSA-44xr-mrhh-qm78, and the upstream commit for implementation details. The patch introduces a RequireSecureSession middleware guarding sensitive routes and corrects the OAuth state handling.

Workarounds

Restrict network access to the Nginx UI management interface using firewall rules or a VPN until the upgrade is applied.
Disable the Casdoor SSO integration and revert to local authentication where feasible.
Place Nginx UI behind a reverse proxy that enforces additional authentication, such as mutual TLS or an authenticating proxy.

bash

# Example: restrict Nginx UI management port to a trusted CIDR with iptables
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP

# Verify installed version after upgrade
nginx-ui -v