CVE-2026-84321: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again.
Details GenerateShortToken() creates an AuthToken row that contains only ShortToken and no long Token. DeleteUserTokens() removes database rows, but when clearing caches it only invalidates entries where authToken.Token != "". This leaves standalone short-token cache entries behind. GetTokenUserByShortToken() checks that cache first and then loads the user by ID, so the stale short token becomes usable again if the account status is restored to true.
Relevant code paths: - internal/user/user.go - internal/user/user.go - internal/user/user.go - api/user/shorttoken.go - internal/middleware/middleware.go
PoC This was verfied locally in an isolated environment with a temporary package-level harness that exercised the real token issuance, revocation, cache, and re-authentication paths.
What the executed test did: 1. Created an enabled user in a temporary SQLite database. 2. Called the real GenerateShortToken(user.ID) function to issue a standalone short token. 3. Verified that the token authenticated successfully and was present in the short-token cache. 4. Disabled the user and called the real DeleteUserTokens(user.ID) function. 5. Verified that the database token rows were removed. 6. Verified that the short-token cache entry still existed after DeleteUserTokens. 7. Re-enabled the same user. 8. Reused the previously deleted short token via the real GetTokenUserByShortToken() path and observed successful authentication.
Observed result from the actual local verification: - The database token rows were removed during revocation. - The short-token cache entry remained present. - Re-enabling the user restored successful authentication through the stale short token.
Impact Any deployment using standalone short tokens is affected. If a short token is stolen, administrative disable/delete-token handling may not fully revoke it. Re-enabling the account within the cache lifetime restores access for the stale token to any HTTP or WebSocket routes that accept short-token authentication.
Other sources
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the shorttoken cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/0xJacky/Nginx-UIto a version that resolves this vulnerability.Fixed in 1.9.10-0.20260703131214-23d1934099b0 - Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Which deployments are affected?
Nginx UI versions prior to 2.4.1 are affected where short-token authentication is accepted for HTTP or WebSocket routes. The issue concerns standalone short tokens created by GenerateShortToken.
What conditions are required for a revoked token to work again?
An attacker or user must retain a previously issued short token that was revoked, and the associated account must be re-enabled before the surviving short-token cache entry expires. The token can then authenticate through routes that accept short-token authentication.
What is the impact of the cache behavior?
Administrative revocation may not immediately invalidate a standalone short token in cache. If the account is re-enabled during the cache lifetime, the token can restore access to authenticated HTTP or WebSocket routes.
What should be done if immediate upgrading is not possible?
Avoid re-enabling accounts associated with revoked standalone short tokens until the relevant short-token cache entries have expired. This prevents a cached revoked token from authenticating again under the described conditions.