Is CVE-2026-84312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84312 being exploited in the wild.

How severe is CVE-2026-84312?

High severity, with a CVSS score of 7.1, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) SEMVER:introduced=0; Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0; Nginx UI prior to patched version.

How is CVE-2026-84312 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84312?

Check whether you run github.com/0xJacky/Nginx-UI (Go), Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84312: Nginx UI Casdoor SSO login CSRF via constant state parameter

Q: Is there a fix for CVE-2026-84312?

No fixed version is recorded yet. Disable Casdoor SSO integration until patched. The OIDC integration in the same codebase is correctly implemented and can be used as an alternative authentication method. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-84312 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-84312?

Check whether you run github.com/0xJacky/Nginx-UI (Go), Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84312 · Severity: high · CVSS 7.1 · Published 2026-10-12

Nginx UI is a web-based interface for managing Nginx server configuration. The Casdoor single sign-on integration uses a constant, predictable OAuth state parameter that is identical across all users, allowing an attacker to forge a login request and trick a victim into authenticating as the attacker. This enables the attacker to read or modify all configurations the victim subsequently accesses.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-84312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84312 being exploited in the wild.
How severe is CVE-2026-84312?: High severity, with a CVSS score of 7.1, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) SEMVER:introduced=0; Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0; Nginx UI prior to patched version.
Is there a fix for CVE-2026-84312?: No fixed version is recorded yet. Disable Casdoor SSO integration until patched. The OIDC integration in the same codebase is correctly implemented and can be used as an alternative authentication method. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84312 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84312?: Check whether you run github.com/0xJacky/Nginx-UI (Go), Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable Casdoor SSO integration until patched. The OIDC integration in the same codebase is correctly implemented and can be used as an alternative authentication method.

Technical details

The vulnerability is a login CSRF in the Casdoor OAuth callback handler. The state parameter is hard-coded to a constant application identifier instead of being randomly generated and validated per-session. The callback accepts any state value without comparing it to a server-side session cookie, allowing an attacker to submit a forged authorization code bound to their own account and authenticate the victim as the attacker. OIDC integration in the same codebase correctly implements state validation.

Affected products

nginx-ui nginx-ui prior to patched version

Identifiers

CVE-2026-84312
GHSA-44xr-mrhh-qm78
GO-2026-6773

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.