CVE-2026-84321: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-84321 is an insufficient session expiration vulnerability in Nginx UI, a web-based management interface for the Nginx web server. Prior to version 2.4.1, standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in the in-memory cache, allowing a revoked token to re-authenticate if the associated account is re-enabled before the cache entry expires. All versions up to and including 2.4.0 are affected. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is classified as CWE-613 (Insufficient Session Expiration). The flaw lies in a logic gap between two functions: GenerateShortToken() creates AuthToken database rows containing only a ShortToken field with no associated long Token value, while DeleteUserTokens() only invalidates cache entries where the long Token field is non-empty — leaving standalone short-token cache entries intact after revocation. When an administrator re-enables the same account before the cache entry expires, GetTokenUserByShortToken() reads the surviving stale cache entry and successfully authenticates the user, restoring access to any HTTP or WebSocket routes that accept short-token authentication. The vulnerability requires low privileges (an attacker must already possess a stolen short token) and is exploitable over the network with low attack complexity (GitHub Advisory).

Successful exploitation allows an attacker holding a previously revoked short token to regain unauthorized access to HTTP and WebSocket routes within Nginx UI after the victim account is re-enabled. The impact includes low confidentiality loss (access to protected data exposed via those routes) and low integrity impact (ability to perform unauthorized actions such as modifying Nginx configurations or triggering operations). Availability is not directly impacted. The scope is limited to the Nginx UI application itself, but unauthorized Nginx configuration changes could have downstream effects on hosted services (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to have previously obtained a valid short token (e.g., through theft or interception) and relies on the specific administrative sequence of disabling and then re-enabling the affected account before the cache expires (GitHub Advisory).

1. Obtain a short token: The attacker acquires a valid short token for a target Nginx UI account through interception, credential theft, or other means while the account is active.
2. Wait for administrative revocation: The administrator disables the target user account and calls DeleteUserTokens(), which removes database rows but leaves the short-token cache entry intact.
3. Monitor for account re-enablement: The attacker waits for the administrator to re-enable the same account before the in-memory cache entry expires.
4. Replay the revoked short token: The attacker sends an HTTP or WebSocket request to a Nginx UI route that accepts short-token authentication, including the previously revoked short token in the request.
5. Achieve unauthorized access: GetTokenUserByShortToken() reads the surviving cache entry, finds the re-enabled user, and grants access — restoring the attacker's session to protected Nginx UI functionality (GitHub Advisory).

• Logs: Nginx UI access logs showing authenticated requests using a short token after the associated account was administratively disabled and re-enabled; repeated short-token authentication events from unexpected IP addresses.
• Application Behavior: Successful API or WebSocket activity attributed to a user account during the window between token revocation and cache expiration, particularly from IP addresses not associated with the legitimate user.
• Database/Cache Discrepancy: Absence of AuthToken database rows for a user while short-token authentication still succeeds, indicating a stale cache entry is being used.

Upgrade Nginx UI to version 2.4.1 or later, which resolves the cache invalidation logic flaw (GitHub Release, Fix Commit). No official configuration-based workaround has been published. As an interim measure, administrators should avoid re-enabling accounts that have had tokens revoked until the cache TTL has elapsed, and should restart the Nginx UI service after revoking tokens to flush the in-memory cache.

The vulnerability was reported by security researcher Vincent550102 and disclosed via GitHub Security Advisories. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified.