CVE-2026-34403
Cross-Site WebSocket Hijacking in Nginx-UI Prior to
Publication date: 2026-04-20
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nginxui | nginx_ui | to 2.3.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1385 | The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Nginx UI web user interface for the Nginx web server prior to version 2.3.5. The issue arises because all WebSocket endpoints use a gorilla/websocket Upgrader with a CheckOrigin function that always returns true, which allows Cross-Site WebSocket Hijacking (CSWSH).
Additionally, authentication tokens are stored in browser cookies that are set via JavaScript without the HttpOnly or explicit SameSite attributes. This combination means that a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance if a logged-in administrator visits the attacker-controlled page.
The vulnerability was fixed in version 2.3.5 of nginx-ui.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to hijack authenticated WebSocket connections to the nginx-ui instance by tricking a logged-in administrator into visiting a malicious webpage.
As a result, the attacker could potentially perform unauthorized actions within the nginx-ui interface with the privileges of the administrator, leading to compromise of the web server's management interface.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade nginx-ui to version 2.3.5 or later, where the issue has been patched.
Additionally, consider securing authentication tokens by setting HttpOnly and explicit SameSite attributes on cookies to prevent unauthorized access via malicious webpages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows Cross-Site WebSocket Hijacking (CSWSH) due to improper origin checks and insecure handling of authentication tokens in browser cookies. This can lead to unauthorized access to the nginx-ui instance by malicious webpages when an administrator is logged in.
Such unauthorized access and potential data exposure could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure authentication mechanisms.
However, the provided information does not explicitly discuss compliance impacts or regulatory considerations.