Servers and applications
GHSA-2rjr-44wx-8qpg
JwtSecret Overwrite via Settings API Causes Session Invalidation and Monopoly
- Severity
- Low 3.8
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 2.9.1
- Attack
- Over the network · Needs an administrator account · No user action needed
- Attacker can
- Change some data · Slow it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L- Sources
- Project advisories (GitHub)
Description
An administrator session or an api:write service token could overwrite JwtSecret through the app settings write. That invalidates every issued session at once, and the change persists in app.ini. Users can sign in again immediately, because sessions are issued and checked with the current secret, so this is a recoverable forced logout rather than an exclusive takeover.
The maintainer narrowed the following points: the prerequisite is an administrator-equivalent credential rather than "any authenticated user"; "session monopoly" and "recovery requires direct server access" do not hold, since other users can sign in again right away.
The JwtSecret field in the cosy framework's App struct lacks the protected:"true" tag, allowing any authenticated user to overwrite it via POST /api/settings/app. This immediately invalidates ALL existing JWT sessions and allows the attacker to monopolize access.
Workarounds
Limit api:write tokens to trusted automation.
Affected software
| Software | Affected versions |
|---|---|
Nginx UIServers and applications · github:0xjacky/nginx-ui |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-2rjr-44wx-8qpg
- github.com https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2rjr-44wx-8qpg