CVE-2026-92378: uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login
A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be authenticated as the previous user and gain unauthorised limited access to device functionality.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices using the Legacy UI Reduced Function Login feature in NT-ware uniFLOW Online are exposed when they enter Service Offline Emergency Mode and the specified timing conditions occur.
What does an attacker need to exploit it?
A subsequent user would need access to the affected device after a previously authenticated user logs out, during the relevant Service Offline Emergency Mode timing condition. Successful exploitation may authenticate that user as the previous user with limited device functionality access.
Is the issue present during normal operation?
The vulnerability is described as occurring under specific timing conditions during Service Offline Emergency Mode. The provided information does not establish that normal online operation is affected.