CVE-2026-34403: medium-severity vulnerability in 0xJacky nginx-ui
Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Nginx-UI allows attackers to hijack WebSocket connections from authenticated users by tricking them into visiting a malicious webpage. This happens because the application doesn't properly verify the origin of WebSocket requests and stores authentication tokens in cookies without proper security settings.
The vulnerability exists in gorilla/websocket Upgrader configuration with CheckOrigin unconditionally returning true, combined with authentication tokens stored in browser cookies lacking HttpOnly and explicit SameSite attributes. An attacker can perform CSWSH by hosting a malicious page that establishes authenticated WebSocket connections to a victim's nginx-ui instance when a logged-in administrator visits the attacker's site, potentially leading to unauthorized administrative actions.
In the same product, most dangerous first.