CVE-2026-92378 in uniFLOW Online
Summary
by MITRE • 09/23/2026
A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be authenticated as the previous user and gain unauthorised limited access to device functionality.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in NT-ware uniFLOW Online Legacy UI Reduced Function Login represents a critical failure in session management protocols during specific operational states known as Service Offline Emergency Mode. This mode is typically designed to allow essential maintenance or emergency operations when standard network connectivity or authentication services are unavailable, relying on local credentials and simplified access controls. However, the implementation of this feature contains a flaw where the lifecycle of user sessions is not properly terminated upon explicit logout actions under these specific timing conditions. Instead of invalidating the session token or clearing the associated state variables immediately, the system retains the authenticated context in memory or storage for an indeterminate period. This behavior creates a window of opportunity where the security boundary between distinct users collapses, allowing subsequent interactions to be processed as if they originated from the previously logged-in user rather than the new actor attempting access.
From a technical perspective, this flaw aligns with CWE-613, which describes insufficient session expiration, and more specifically CWE-384 regarding Session Fixation or improper session invalidation mechanisms. The core issue lies in the failure to properly clear server-side state or client-side identifiers when transitioning from an authenticated state to an unauthenticated one within this legacy interface component. When a user logs out during Service Offline Emergency Mode, the system fails to send the necessary signals to destroy the active session object. Consequently, any subsequent request made by a different individual using the same device or terminal can inadvertently reuse these residual credentials. This is particularly dangerous in shared environments such as print rooms or office hubs where multiple users interact with the same physical interface sequentially without strict isolation of their digital identities.
The operational impact of this vulnerability allows an attacker to gain unauthorized limited access to device functionality by exploiting the retained session state. An adversary does not need to compromise passwords or exploit complex injection flaws; instead, they simply wait for a legitimate user to log out and then immediately interact with the interface. The system will authenticate the new user as the previous one, granting them privileges that were intended only for the original account holder. This could lead to unauthorized printing of sensitive documents, access to configuration settings restricted to administrators or specific service roles, or manipulation of job queues. While the description notes limited access, even restricted functionality can be leveraged for denial-of-service attacks, data leakage through print output, or as a stepping stone for further lateral movement if other services are linked to this session context.
This type of vulnerability is often categorized under MITRE ATT&CK technique T1078, specifically Valid Accounts, where an attacker uses legitimate credentials that have been hijacked or retained improperly. In the context of physical access scenarios common in print management systems, it also relates to social engineering vectors where a malicious actor might prompt a victim to log out quickly before taking over the terminal. The risk is exacerbated by the legacy nature of the UI component, which may lack modern security controls such as secure cookie flags, robust token rotation, or strict statelessness that are standard in newer web applications.
Mitigation strategies must focus on enforcing strict session termination protocols regardless of the operational mode. Developers should ensure that logout actions trigger immediate and irreversible destruction of all associated server-side sessions and client-side tokens. Implementing short-lived session timeouts during Service Offline Emergency Mode can reduce the window of exposure, although explicit invalidation upon logout remains the primary defense. Additionally, introducing unique session identifiers for each login event and verifying these against current context on every request can prevent reuse of stale credentials. For administrators using NT-ware uniFLOW Online, applying vendor-provided patches that address this specific legacy UI flaw is essential. Until such updates are applied, restricting physical access to devices running in Service Offline Emergency Mode and monitoring logs for anomalous session continuity patterns may help mitigate the risk of unauthorized access through retained sessions.