NGINX
CVE-2024-10318: NGINX OpenID Connect Vulnerability
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| NGINX OpenID Connect fa1ad160e2637d1d583611124478039170d726ab | 133504f4fd9f72f3e36668f9f2f3d32a86fcb269 or later |
| NGINX Instance Manager 2.5 | 2.17.4 or later |
| NGINX API Connectivity Manager 1.0 | 1.9.3 or later |
| NGINX Ingress Controller 1.0 | 3.7.1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.