CVE-2026-84321: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Q: Which deployments are affected?

Nginx UI versions prior to 2.4.1 are affected where short-token authentication is accepted for HTTP or WebSocket routes. The issue concerns standalone short tokens created by GenerateShortToken.

Q: What conditions are required for a revoked token to work again?

An attacker or user must retain a previously issued short token that was revoked, and the associated account must be re-enabled before the surviving short-token cache entry expires. The token can then authenticate through routes that accept short-token authentication.

Q: What is the impact of the cache behavior?

Administrative revocation may not immediately invalidate a standalone short token in cache. If the account is re-enabled during the cache lifetime, the token can restore access to authenticated HTTP or WebSocket routes.

Q: What should be done if immediate upgrading is not possible?

Avoid re-enabling accounts associated with revoked standalone short tokens until the relevant short-token cache entries have expired. This prevents a cached revoked token from authenticating again under the described conditions.

Published Oct 12, 2026

Updated

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the shorttoken cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.

Affected Software

1 affected component

Nginx UI Nginx UI<2.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nginx UI to a version that resolves this vulnerability.
Fixed in 2.4.1

Event History

Oct 12, 2026

CVE Published

via MITRE·08:49 PM

Data Sourced

via MITRE·08:49 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Nginx UI versions prior to 2.4.1 are affected where short-token authentication is accepted for HTTP or WebSocket routes. The issue concerns standalone short tokens created by GenerateShortToken.

What conditions are required for a revoked token to work again?

An attacker or user must retain a previously issued short token that was revoked, and the associated account must be re-enabled before the surviving short-token cache entry expires. The token can then authenticate through routes that accept short-token authentication.

What is the impact of the cache behavior?

Administrative revocation may not immediately invalidate a standalone short token in cache. If the account is re-enabled during the cache lifetime, the token can restore access to authenticated HTTP or WebSocket routes.

What should be done if immediate upgrading is not possible?

Avoid re-enabling accounts associated with revoked standalone short tokens until the relevant short-token cache entries have expired. This prevents a cached revoked token from authenticating again under the described conditions.

CVE-2026-84321: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What conditions are required for a revoked token to work again?

What is the impact of the cache behavior?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What conditions are required for a revoked token to work again?

What is the impact of the cache behavior?

What should be done if immediate upgrading is not possible?