Nginx UI CVE-2026-84312

Exploitable only when Nginx UI (prior to 2.4.1) is deployed with Casdoor OAuth/SSO configured, because the vulnerable GetCasdoorUri/CasdoorCallback flow uses the configured Casdoor application name as a constant OAuth 'state' and the callback does not bind that state to the initiating browser session. Exploitation is LIMITED by: (1) required victim interaction (UI:R) - the targeted user must be induced to open the attacker's authorization link; (2) the deployment must use Casdoor SSO - instances relying on local/password or other authentication are not affected; and (3) only versions before 2.4.1 are vulnerable. Attacker is unauthenticated (PR:N).

This is a genuine but conditionally-gated authentication flaw (CWE-287) rather than a universally critical issue. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms a network-reachable, low-complexity, unauthenticated attack - strong signals - but it is tempered by UI:R (the victim must click an attacker-supplied link) and, critically, by the fact that the vulnerable code path (GetCasdoorUri/CasdoorCallback) only exists when the deployment is configured to use Casdoor OAuth/SSO. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no evidence of active exploitation or mass-scanning pressure at this time. The CVSS claims C:H/I:L, implying session/account compromise of the Nginx UI admin panel, which is plausible for a login-CSRF/OAuth-state flaw against a privileged management interface. Net: a legitimate medium-high priority for the subset of operators running Nginx UI with Casdoor SSO, but low urgency for the (likely majority) of deployments using local authentication. One data caveat worth flagging for triage: the provided source-code diff hardens backup endpoints with RequireSecureSession and does NOT directly show the OAuth state-binding fix described in the summary - the authoritative evidence for the specific flaw is the advisory GHSA-44xr-mrhh-qm78, not the shown hunk.

An attacker running an Nginx UI instance configured with Casdoor crafts an authorization link using the fixed, predictable application-name 'state' value and lures a victim administrator into clicking it (e.g., via phishing). Because CasdoorCallback never binds the state to the victim's browser session, the victim's browser silently completes the attacker-controlled authorization flow and the callback mints an Nginx UI session for the identity returned by the attacker's authorization code. No public exploit identified at time of analysis; exploitation requires the network-reachable UI and victim interaction (UI:R).