Live › vulnerability › CVE-2026-84321
Go to dashboardNginx UI, a web interface for managing Nginx, can keep a revoked short-lived login token in its cache. If the owning account is re-enabled before the cache entry expires, that old token authenticates again and restores access to HTTP and WebSocket routes that accept short tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod against 1.9.10-0.20260703131214-23d1934099b0 (sources also mention version 2.4.1 as the fix).
1.9.10-0.20260703131214-23d1934099b0 or later (sources also state 2.4.1 as the fixed release; the two version references conflict)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-84321")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.