CVE-2020-5894: F5 Nginx Controller

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.

Affected products

• F5 Nginx Controller: from 3.0.0, up to and including 3.3.0

Published 2020-05-07. Last modified 2026-06-17.