CVE-2026-84321: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

October 15, 2026

Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again.

References

github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
github.com/0xJacky/nginx-ui/security/advisories/GHSA-wq4w-vwvq-q3x9
github.com/advisories/GHSA-wq4w-vwvq-q3x9
nvd.nist.gov/vuln/detail/CVE-2026-84321

Code Behaviors & Features

Detect and mitigate CVE-2026-84321 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →