CVE-2026-92378 Overview
CVE-2026-92378 is a session management vulnerability [CWE-613] affecting the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. The flaw exists in the Service Offline Emergency Mode workflow, where a previously authenticated session may be retained after a user logs out. Under specific timing conditions, a subsequent user at the affected device can inherit the prior session and gain unauthorized limited access to device functionality as the previous user.
Critical Impact
A subsequent physical user of the device can be authenticated as the previous user, gaining unauthorized limited access to device functionality tied to the retained session.
Affected Products
- NT-ware uniFLOW Online — Legacy UI Reduced Function Login feature
- Canon multifunction devices integrated with uniFLOW Online (per Canon PSIRT advisory)
- Deployments operating in Service Offline Emergency Mode
Discovery Timeline
- 2026-09-23 - CVE-2026-92378 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-92378
Vulnerability Analysis
The vulnerability resides in the Legacy UI Reduced Function Login flow used when uniFLOW Online enters Service Offline Emergency Mode. This mode allows devices to continue limited operation when the online service is unreachable. During this fallback path, the session teardown logic does not consistently invalidate the previously authenticated user context on logout.
When a second user initiates login through the Reduced Function Login interface within a narrow timing window, the retained session state is presented to that user. The device then treats the new user as the previously authenticated identity, granting the same limited feature set without re-authentication.
Because exploitation requires physical access to the device and user interaction, the vulnerability is scoped to walk-up attacks on shared multifunction devices. The impact is bounded by the permissions of the retained session and the reduced feature set available in emergency mode.
Root Cause
The root cause is insufficient session invalidation during the logout sequence in the Legacy UI Reduced Function Login handler when the service is operating offline. The session identifier or authentication context persists in server-side state beyond the intended lifetime, mapped to CWE-613 (Insufficient Session Expiration).
Attack Vector
Exploitation requires an attacker to physically approach an affected device shortly after a legitimate user logs out while the system is in Service Offline Emergency Mode. The attacker interacts with the Reduced Function Login prompt during the timing window in which the prior session remains valid, at which point the device authenticates the attacker as the previous user. No credentials or exploitation code are required. Refer to the NTWare Security Advisory for vendor-specific technical detail.
Detection Methods for CVE-2026-92378
Indicators of Compromise
- Device activity or print or scan jobs attributed to a user account whose owner was not present at the device.
- Successive Reduced Function Login events for different physical users tied to a single unbroken session ID.
- Session activity continuing after a logout event during periods when uniFLOW Online was in Service Offline Emergency Mode.
Detection Strategies
- Correlate device audit logs with badge or proximity access records to surface user identity mismatches at the multifunction device.
- Alert on transitions into Service Offline Emergency Mode and flag Reduced Function Login sessions that occur during those windows for review.
- Review uniFLOW Online authentication logs for logout events that are not followed by a corresponding session termination entry.
Monitoring Recommendations
- Enable verbose session lifecycle logging on uniFLOW Online and forward events to a centralized log platform for retention and correlation.
- Monitor the frequency and duration of Service Offline Emergency Mode occurrences to reduce the exposure window.
- Establish baseline usage patterns per user and alert on job submissions that deviate from expected device or time-of-day patterns.
How to Mitigate CVE-2026-92378
Immediate Actions Required
- Apply the patched version of uniFLOW Online as directed by the NTWare Security Advisory.
- Review Canon device firmware and integration guidance published by the Canon Security Advisory Information portal and update affected devices.
- Audit recent Service Offline Emergency Mode occurrences and reconcile session activity against expected user presence.
Patch Information
NT-ware has published a security advisory addressing the session retention issue in the Legacy UI Reduced Function Login flow. Administrators should consult the NTWare Security Advisory for the fixed release information and coordinated Canon device updates listed on the Canon PSIRT portal.
Workarounds
- Disable the Legacy UI Reduced Function Login feature where operationally acceptable until the patch is deployed.
- Restrict physical access to affected multifunction devices, particularly in shared or public areas.
- Instruct users to verify that the login screen shows no active session before initiating a new authentication at the device.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.