CVE-2026-84312: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Which deployments are affected?
Nginx UI versions prior to 2.4.1 are affected when Casdoor SSO is configured and used. The issue is in the Casdoor OAuth callback flow.
What does an attacker need to exploit this?
An attacker does not need to authenticate to Nginx UI. They need to cause a victim to complete an attacker-controlled Casdoor authorization flow, such as by getting the victim's browser to follow the flow.
What is the practical impact on a victim?
The callback can create a Nginx UI session in the victim's browser for the identity returned by the attacker-controlled authorization code. This can result in the victim being logged into the wrong account.
How can this be remediated?
Upgrade Nginx UI to version 2.4.1, which fixes the constant OAuth state handling and validates state against the initiating browser session.