CVE-2026-84321 in Nginx UI
Summary
by MITRE • 10/13/2026
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Nginx UI prior to version 2.4.1 represents a critical logic flaw within the token management subsystem, specifically affecting the lifecycle of short-lived authentication tokens used for HTTP and WebSocket route access. This issue stems from an inconsistency between how short tokens are generated and how they are invalidated during user account operations. When the GenerateShortToken function is invoked to create a new standalone short-token record, it does not populate or associate a corresponding long Token value within that specific record structure. However, the DeleteUserTokens function, which is responsible for revoking active sessions and clearing cached authentication data, contains a conditional check that only proceeds with invalidating cache entries if the associated long Token field is non-empty. Because short-token records lack this long token reference by design, the deletion logic fails to trigger, leaving the revoked short token intact within the application's memory or database cache.
This architectural oversight creates a significant security gap where an attacker can maintain persistent access even after administrative revocation actions have been taken against a user account. If an administrator disables and subsequently re-enables a compromised user account before the cached short-token entry naturally expires, the system retrieves the surviving token via the GetTokenUserByShortToken function. Since this retrieval mechanism does not verify whether the token was previously revoked or if its parent account status has changed since issuance, it successfully restores authentication credentials to the attacker. This allows unauthorized access to sensitive HTTP endpoints and WebSocket connections that rely on short-token validation, effectively bypassing intended security controls designed to limit session duration and enforce immediate revocation upon account suspension.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves the failure of an application to properly restrict access for users who should not have permission to use specific resources. Furthermore, in the context of the MITRE ATT&CK framework, this behavior facilitates Persistence through Tactic TA0003 and potentially Privilege Escalation if short tokens are used across different privilege levels or contexts. The flaw is particularly dangerous because it exploits a race condition-like state where administrative actions do not immediately propagate to all authentication verification paths due to the decoupled nature of token storage fields.
To mitigate this vulnerability, organizations must upgrade Nginx UI to version 2.4.1 or later, which corrects the logic in DeleteUserTokens to properly handle short-token records regardless of the presence of a long Token value. In addition to applying the patch, administrators should implement strict session management policies that include immediate cache invalidation upon account status changes and consider implementing token binding mechanisms that tie tokens more tightly to specific user states or device fingerprints. Regular auditing of authentication logs can also help detect anomalous patterns where revoked accounts exhibit continued activity, providing an additional layer of defense against exploitation while the software update is being deployed across infrastructure environments.