CVE-2026-34403 Details
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in Nginx UI versions prior to 2.3.5. All WebSocket endpoints in these versions use a gorilla/websocket Upgrader that allows all origins, enabling malicious websites to hijack WebSocket connections. This issue is exacerbated by the application's use of unprotected cookies for authentication tokens, allowing attackers to establish unauthorized WebSocket connections with the privileges of logged-in administrators.
Users are advised to update to Nginx UI version 2.3.5 or later. After updating, ensure that all WebSocket upgraders validate origins properly and that authentication tokens are stored in cookies with secure attributes. Additionally, consider adding CSRF token validation to WebSocket upgrade requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5 | [email protected] | ProductRelease Notes |
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1385 | Missing Origin Validation in WebSockets | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nginxui nginx ui | < 2.3.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |