CVE-2026-84321 Overview
CVE-2026-84321 affects Nginx UI, a web user interface for the Nginx web server. The vulnerability stems from an insufficient session expiration flaw [CWE-613] in the short-token authentication cache. Prior to version 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value. However, DeleteUserTokens only invalidates cached entries when the long Token field is nonempty. A revoked short token therefore remains in the short_token cache and can authenticate again if the associated account is re-enabled before the cache entry expires. The issue is fixed in Nginx UI version 2.4.1.
Critical Impact
Revoked short tokens can be reused to authenticate against HTTP and WebSocket routes after an account is re-enabled, bypassing intended revocation controls.
Affected Products
- Nginx UI versions prior to 2.4.1
- HTTP routes accepting short-token authentication
- WebSocket routes accepting short-token authentication
Discovery Timeline
- 2026-10-12 - CVE-2026-84321 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-84321
Vulnerability Analysis
The flaw resides in the token lifecycle management logic of Nginx UI. The system supports two token types: long tokens stored with an associated Token field, and short tokens that exist as standalone records. The GenerateShortToken function creates short-token entries without populating the long Token field. The DeleteUserTokens function, which is responsible for revocation during account disablement, iterates over cached entries and only invalidates those where the long Token field is nonempty. As a result, short tokens survive the revocation routine and remain in the short_token cache until their natural TTL expires. When an administrator re-enables the previously disabled account, GetTokenUserByShortToken reads the still-valid cache entry and restores authenticated access.
Root Cause
The root cause is incomplete cache invalidation logic in DeleteUserTokens. The function uses the presence of a long Token value as a filter condition, which excludes short-token-only records from revocation. This is a classic insufficient session expiration weakness [CWE-613] where the revocation path does not cover all token classes created by the system.
Attack Vector
Exploitation requires an attacker to have previously obtained a valid short token for a user account that is subsequently disabled. The attacker retains the short token during the disablement window. When an administrator re-enables the account, perhaps after an investigation or policy reset, the attacker replays the short token against HTTP or WebSocket endpoints that accept short-token authentication. The surviving cache entry authenticates the request without requiring fresh credentials. The attack succeeds within the token's original TTL window.
// Security patch in api/backup/router.go - hardens routes with RequireSecureSession middleware
func InitRouter(r *gin.RouterGroup) {
- r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+ r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)
}
Source: GitHub Commit 23d1934
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84321
Indicators of Compromise
- Authentication events on HTTP or WebSocket routes using a short token belonging to a recently disabled and re-enabled account.
- Session activity from a user account that resumes immediately after re-enablement without a fresh login event.
- Access patterns from the same client identifier spanning an account disable/enable cycle.
Detection Strategies
- Correlate account state changes in Nginx UI audit logs with subsequent short-token authentication events on the same account.
- Monitor WebSocket upgrade requests that authenticate via short tokens tied to accounts with recent lifecycle changes.
- Alert on token reuse where the token issuance timestamp predates the most recent account disablement timestamp.
Monitoring Recommendations
- Enable verbose authentication logging in Nginx UI and forward records to a centralized logging platform.
- Track administrative actions that disable or re-enable accounts and tag downstream authentication events.
- Review access logs for Nginx UI management endpoints exposed to untrusted networks.
How to Mitigate CVE-2026-84321
Immediate Actions Required
- Upgrade Nginx UI to version 2.4.1 or later, which fixes the cache invalidation logic.
- Audit all user accounts that have been disabled and re-enabled since deployment and rotate any associated tokens.
- Restrict network exposure of the Nginx UI management interface to trusted administrative networks only.
Patch Information
The fix is available in Nginx UI version 2.4.1. Review the GitHub Security Advisory GHSA-wq4w-vwvq-q3x9 and the GitHub Release v2.4.1 notes. The upstream commit 23d1934 also hardens sensitive routes with the RequireSecureSession middleware.
Workarounds
- If upgrading is not immediately possible, avoid re-enabling previously disabled accounts until the short-token cache TTL has fully elapsed.
- Delete all accounts rather than disabling them when offboarding or responding to suspected compromise.
- Place the Nginx UI management interface behind a VPN or network ACL to limit who can present tokens to the service.
# Upgrade Nginx UI to the patched release
# Example using Docker
docker pull uozi/nginx-ui:2.4.1
docker stop nginx-ui && docker rm nginx-ui
docker run -d --name nginx-ui -p 9000:9000 uozi/nginx-ui:2.4.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
