{"id":"CVE-2026-84312","kind":"vulnerability","aliases":["CVE-2026-84312","GHSA-44xr-mrhh-qm78","GO-2026-6773"],"related":[],"title":"Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.","summary":"Nginx UI's Casdoor SSO login uses a fixed value as the OAuth state parameter and never checks it against the browser session. An attacker can get a victim's browser to finish a login the attacker started, and the callback then creates an Nginx UI session for the attacker's identity.","severity":"high","cvss":7.1,"epss":0.00175,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["casdoor","go","nginx-ui","package","self-hosted"],"not_affected_if":["casdoor-sso-disabled","version-2.4.1-or-later"],"how_to_check":"Check the version of github.com/0xJacky/Nginx-UI in use; it is affected before 2.4.1.\nIf Casdoor SSO is enabled in the Nginx UI config, the instance is exposed to this flaw.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 2.4.1 or later.\nUntil then, disable Casdoor SSO login if it is enabled.","status":"open","published_at":"2026-10-12T22:17:05+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:21+00:00","updated_at":"2026-10-23T19:56:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:56:21Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 2.4.1 or later.\nUntil then, disable Casdoor SSO login if it is enabled.","summary":"Nginx UI's Casdoor SSO login uses a fixed value as the OAuth state parameter and never checks it against the browser session. An attacker can get a victim's browser to finish a login the attacker started, and the callback then creates an Nginx UI session for the attacker's identity.","category":"package","who_cares":["nginx-ui","go","self-hosted","casdoor"],"confidence":0.8,"analyst_note":"Sources do not say which Nginx UI versions are affected beyond 'prior to 2.4.1' or whether the flaw is reachable with default config; check the GHSA-44xr-mrhh-qm78 advisory at https://pkg.go.dev/vuln/GO-2026-6773 for the affected range and any workaround.","how_to_check":"Check the version of github.com/0xJacky/Nginx-UI in use; it is affected before 2.4.1.\nIf Casdoor SSO is enabled in the Nginx UI config, the instance is exposed to this flaw.\nunknown for any other check the sources do not describe.","needs_analyst":true,"not_affected_if":["casdoor-sso-disabled","version-2.4.1-or-later"],"severity_if_unknown":"high"},"cost_usd":0.000461,"input_tokens":2227,"output_tokens":477,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A,27A '-6773':25A '-84312':17A,28A '/0xjacky/nginx-ui':14A,31A '2.4.1':107C,179C '44xr':20A 'applic':113C 'attack':65B,77B,90B,140C,151C 'attacker-control':150C 'author':154C,171C 'bound':132C 'browser':62B,71B,136C,146C 'callback':3A,81B,158C 'casdoor':1A,32B,44B,112C,153C 'casdoorcallback':122C 'caus':142C 'check':58B 'code':172C 'compar':125C 'complet':148C 'configur':111C 'constant':6A,117C 'control':152C 'creat':83B 'csrf':10A 'cve':15A,26A 'finish':73B 'fix':49B,176C 'flow':155C 'get':67B 'getcasdooruri':108C 'ghsa':19A 'ghsa-44xr-mrhh-qm78':18A 'github.com':13A,30A 'github.com/0xjacky/nginx-ui':12A,29A 'go':23A,33B 'host':40B 'ident':92B,167C 'initi':135C 'interfac':99C 'issu':174C 'login':9A,46B,75B 'mint':160C 'mrhh':21A 'name':114C 'never':57B 'nginx':35B,41B,85B,93C,102C,162C 'nginx-ui':34B 'oauth':53B,118C 'packag':37B 'paramet':8A,55B 'prior':105C 'qm78':22A 'return':168C 'self':39B 'self-host':38B 'server':104C 'session':63B,87B,137C,164C 'sso':2A,45B 'start':78B 'state':7A,54B,119C,128C 'submit':127C 'ui':36B,42B,86B,94C,163C 'unauthent':139C 'use':4A,47B,109C 'user':98C 'valu':50B,120C,131C 'version':178C 'victim':69B,144C 'web':97C,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6773","url":"https://pkg.go.dev/vuln/GO-2026-6773","severity":null,"published_at":"2026-10-19T21:08:39+00:00","modified_at":"2026-10-19T21:08:39+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84312","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84312","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-84312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84312","severity":null,"published_at":"2026-10-12T22:17:05+00:00","modified_at":"2026-10-14T12:17:18+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}