{"metadata": {"vulnerability": "CVE-2026-84312", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-01T16:17:43.079Z", "date_only": false, "value": "2026-09-01T16:17:43.079Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-84312", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T21:16:56.072Z", "date_only": false, "value": "2026-10-12T21:16:56.072Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-84312", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T21:16:56.072Z", "date_only": false, "value": "2026-10-12T21:16:56.072Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-84312", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T22:04:01.537Z", "date_only": false, "value": "2026-10-12T22:04:01.537391Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430199318050330", "record": "CVE-2026-84312", "field": "creation_timestamp", "uuid": "0df5f9a2-9ec3-4458-9369-281b707e5ba2", "content": "CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84312https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1#0xJacky #nginx-ui#CVE_2026_84312#bot", "url": "https://infosec.exchange/users/cve/statuses/117430199318050330"}, {"timestamp": "2026-10-12T22:17:05Z", "date_only": false, "value": "2026-10-12T22:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-44XR-MRHH-QM78", "record": "GHSA-44XR-MRHH-QM78", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T22:17:05.263Z", "date_only": false, "value": "2026-10-12T22:17:05.263", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84312", "record": "FKIE_CVE-2026-84312", "field": "published"}, {"timestamp": "2026-10-14T11:34:39.668Z", "date_only": false, "value": "2026-10-14T11:34:39.668412Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-84312", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T11:34:39.668Z", "date_only": false, "value": "2026-10-14T11:34:39.668412Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84312", "record": "FKIE_CVE-2026-84312", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T11:36:49.978Z", "date_only": false, "value": "2026-10-14T11:36:49.978Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-84312", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T11:36:49.978Z", "date_only": false, "value": "2026-10-14T11:36:49.978Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-84312", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T12:17:18.203Z", "date_only": false, "value": "2026-10-14T12:17:18.203", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84312", "record": "FKIE_CVE-2026-84312", "field": "lastModified"}, {"timestamp": "2026-10-15T20:12:52Z", "date_only": false, "value": "2026-10-15T20:12:52Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-44XR-MRHH-QM78", "record": "GHSA-44XR-MRHH-QM78", "field": "published"}, {"timestamp": "2026-10-15T20:12:52Z", "date_only": false, "value": "2026-10-15T20:12:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-44XR-MRHH-QM78", "record": "GHSA-44XR-MRHH-QM78", "field": "modified"}]}