Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · GitLab Advisory Database

   Detected

   Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again.

Affected

• golang github.comversion unspecified

Sources

• GitLab Advisory DatabasePackage advisoryCVE-2026-84321

  Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again.

  advisories.gitlab.com