The vulnerability arises because GetCasdoorUri sets a constant OAuth state value using the Casdoor application name, and the CasdoorCallback does not compare the received state with any value bound to the initiating browser session. An unauthenticated attacker can force a victim’s browser to complete an attacker‑controlled Casdoor authorization flow and the callback can mint a Nginx UI session for the identity returned by that authorization code. This allows the attacker to obtain authenticated access to the affected Nginx UI system, effectively bypassing authentication (CWE‑287) and enabling CSRF‑style abuse (CWE‑352). The primary consequence is unauthorized access, potentially granting privileged functionality to the attacker.

The vendor is 0xJacky and the product is Nginx UI. All releases prior to version 2.4.1 are affected; the issue is fixed in 2.4.1 and later.

The CVSS score of 7.1 indicates a medium‑high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to trick a victim’s browser into invoking the Casdoor callback, so it relies on user interaction and the victim must be using a browser that can reach the affected Nginx UI instance. While remote exploitation is not possible without user participation, the risk of privilege escalation within the UI remains significant for systems that rely on Casdoor SSO for authentication.