CVE-2026-84312

The Nginx UI web interface for the Nginx web server is vulnerable to a login CSRF attack in versions prior to 2.4.1 . The root cause is that the GetCasdoorUri function uses a constant OAuth state value (the configured Casdoor application name), and the CasdoorCallback function fails to validate t...