Nginx-UI
Nginx-UI Security Releases - October 2026
nginx-ui-2026-10 Oct 1, 2026 Source: Vendor
Nginx-UI security advisories for October 2026.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://github.com/advisories/GHSA-44xr-mrhh-qm78
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2026-84312
BR2026-0000-024993
Nginx-UI
unclaimed
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Credited as @therawdev
CVE-2026-84313
BR2026-0000-024995
Nginx-UI
unclaimed
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Credited as @therawdev