fkie_cve-2026-84312

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.

GHSA-44xr-mrhh-qm78 — Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Affected: Go: Nginx-UI

## Summary

In the Casdoor SSO flow, the OAuth `state` parameter is hard-coded to `settings.CasdoorSettings.Application` — a value identical for every user and every login. The callback handler accepts whatever `state` the client sends without comparing it to anything stored in the user agent, enabling a login-CSRF: an attacker can force the victim's browser to authenticate as the *attacker*.

## Details

`api/user/casdoor.go:92-117` (`GetCasdoorUri`):

```go func GetCasdoorUri(c *gin.Context) { clientId := settings.CasdoorSettings.ClientId redirectUri := settings.CasdoorSettings.RedirectUri state := settings.CasdoorSettings.Application // ← constant ... c.JSON(http.StatusOK, gin.H{ "uri": fmt.Sprintf( "%s/login/oauth/authorize?client_id=%s&response_type=code&redirect_uri=%s&state=%s&scope=read", endpoint, clientId, encodedRedirectUri, state), }) } ```

`api/user/casdoor.go:24-90` (`CasdoorCallback`):

```go type CasdoorLoginUser struct { Code string `json:"code" binding:"required,max=255"` State string `json:"state" binding:"required,max=255"` }

func CasdoorCallback(c *gin.Context) { var loginUser CasdoorLoginUser if !cosy.BindAndValid(c, &loginUser) { return } ... // state is NEVER compared to a per-session value token, err := casdoorsdk.GetOAuthToken(loginUser.Code, loginUser.State) ... u, err := user.GetUser(claims.Name) // username from Casdoor's JWT ... use…

Most recent entries from all

bdu:2026-16623

fkie_cve-2026-84312

GHSA-44xr-mrhh-qm78 — Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)