Nginx UI’s token generation routine creates short‑token records that lack an accompanying long Token value. When a user is revoked, the DeleteUserTokens function only clears cached entries if a long Token exists; therefore a revoked short token can persist in the cache. After the account is re‑enabled, the system reads the surviving short token and grants access again to any HTTP or WebSocket endpoints that accept short‑token authentication. The primary impact is that authenticated access can be restored without re‑authentication, effectively bypassing the revoke action and providing an attacker who holds the short token a path to access protected resources.

The vulnerability affects the open‑source Nginx UI project (0xJacky/nginx‑ui) running any version prior to 2.4.1.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is currently unavailable, suggesting that exploitation probability is unclear. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to possess a valid short token and have the target account re‑enabled before the cache entry expires. The attack vector is thus a remote condition that relies on HTTP communication to a Nginx UI instance. While the vulnerability does not enable privilege escalation beyond the roles granted by the token, it permits unauthorized re‑access to routes that would otherwise be restricted after revocation.