Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

Nginx-UI allows attackers to hijack WebSocket connections from authenticated users by tricking them into visiting a malicious webpage. This happens because the application doesn't properly verify the origin of WebSocket requests and stores authentication tokens in cookies without proper security settings.

The vulnerability exists in gorilla/websocket Upgrader configuration with CheckOrigin unconditionally returning true, combined with authentication tokens stored in browser cookies lacking HttpOnly and explicit SameSite attributes. An attacker can perform CSWSH by hosting a malicious page that establishes authenticated WebSocket connections to a victim's nginx-ui instance when a logged-in administrator visits the attacker's site, potentially leading to unauthorized administrative actions.