A previously issued bearer token remains valid for the entire token lifetime even after the associated user account is disabled by an administrator. This flaw allows an attacker who has obtained a JWT to continue reading and modifying protected resources, bypassing the intended access revocation. The weakness is classified as CWE‑284 and CWE‑863, indicating an improper authorization state and an authentication bypass token issue.

The vulnerability affects Nginx UI, a web interface for the Nginx web server, when deployed before version 2.3.4. The affected product is managed by the 0xJacky project.

The CVSS score of 8.6 highlights a high severity due to the persistence of unauthorized access. While no EPSS score is available and the issue is not listed in CISA KEV, the potential for exploitation is significant. An attacker must obtain a valid JWT—typically through compromising the user account, phishing, or other credential theft—before the account is disabled. Once disabled, the attacker can continue to use the token until its expiry, potentially creating new accounts and escalating privileges. The attack vector is therefore inferred to be a post‑compromise use of a retained token.