CVE-2026-84312: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-84312 is a login CSRF (Cross-Site Request Forgery) vulnerability in Nginx UI, a web-based management interface for the Nginx web server. The flaw exists in the Casdoor SSO OAuth flow, where the state parameter is hard-coded to a constant application name rather than a per-session random value, and the callback handler never validates the submitted state against a session-bound value. This allows an unauthenticated attacker to force a victim's browser to complete an attacker-controlled Casdoor authorization flow, resulting in the victim's session being minted for the attacker's identity. All versions prior to 2.4.1 are affected. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-287 (Improper Authentication) and CWE-352 (Cross-Site Request Forgery). In api/user/casdoor.go, the GetCasdoorUri function sets state := settings.CasdoorSettings.Application — a static, predictable value shared across all users and sessions. The CasdoorCallback function accepts whatever state value the client submits without comparing it to any per-session stored value, unlike the correctly implemented OIDC flow in api/user/oidc.go which generates a random state, stores it in a cookie, and validates it on callback. An attacker initiates their own Casdoor authorization flow to obtain an authorization code, then tricks a victim's browser into submitting that code to the Nginx UI callback endpoint, causing the server to mint a JWT session for the attacker's identity on the victim's browser (GitHub Advisory).

Successful exploitation results in a login CSRF attack where the victim is silently authenticated as the attacker within Nginx UI. The victim, believing they are operating under their own account, may upload TLS keys, configure sites, or modify sensitive Nginx settings — all of which the attacker can then read or leverage. This is particularly dangerous in organizational deployments where Casdoor maps internal identities, as the attacker can attribute malicious configuration changes to the victim. The CVSS assessment reflects high confidentiality impact and low integrity impact with no availability impact (GitHub Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The attack requires user interaction (the victim must visit an attacker-controlled page), but no authentication or special privileges are required from the attacker. The EPSS score is reported as 0.0, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The advisory credits Vishal Shukla (@shukla304) and Sechub.dev AI Agent as the reporters (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Nginx UI instance (version ≤ 2.3.9) configured to use Casdoor SSO. Confirm Casdoor integration is active by observing the login page or probing the /api/auth/casdoor endpoint.
2. Obtain attacker's authorization code: The attacker initiates a Casdoor OAuth authorization flow using their own Casdoor account credentials, obtaining a valid authorization code for the attacker's identity.
3. Craft malicious page: The attacker hosts a web page containing a form that auto-submits the captured authorization code and the known constant state value (the Casdoor application name) to the victim's Nginx UI callback endpoint (e.g., POST /api/auth/casdoor/callback).
4. Deliver to victim: The attacker tricks the victim into visiting the malicious page (e.g., via phishing email or link), causing the victim's browser to automatically submit the form.
5. Session minting: The Nginx UI callback exchanges the attacker's code with Casdoor, retrieves the attacker's identity from the JWT claims, and mints a Nginx UI session JWT and secure session cookie for the attacker's account — now set in the victim's browser.
6. Data exfiltration: The victim, now authenticated as the attacker, interacts with Nginx UI (configuring sites, uploading TLS keys, etc.), all of which the attacker can access or monitor through their own account (GitHub Advisory).

• Network: Unexpected POST requests to the Nginx UI Casdoor callback endpoint (e.g., /api/auth/casdoor/callback) originating from unusual or external IP addresses; OAuth state parameter values in callback requests matching the static Casdoor application name rather than a random token.
• Logs: Nginx UI access logs showing callback requests with a state value equal to the configured Casdoor application name from IPs not associated with the legitimate user; multiple callback requests in rapid succession from different source IPs using the same code.
• File System / Session: Unexpected _nginx_ui_secure_session cookies issued to sessions that did not originate from a normal login flow; JWT tokens issued for the attacker's Casdoor identity appearing in victim browser sessions.
• Application Behavior: Configuration changes (site edits, TLS key uploads, DNS credential modifications) attributed to a user account that the legitimate account holder did not perform (GitHub Advisory).

Upgrade Nginx UI to version 2.4.1 or later, which fixes the vulnerability by generating a cryptographically random state value per login attempt, storing it in a casdoor_state cookie, and validating it on callback — mirroring the correct OIDC implementation (GitHub Release, GitHub Commit). As a temporary workaround for those unable to upgrade immediately, disable Casdoor SSO entirely and use the OIDC integration (api/user/oidc.go), which is correctly implemented with proper state validation (GitHub Advisory).