{"id":"CVE-2026-34403","aliases":["GHSA-78mf-482w-62qj","GO-2026-5210"],"url":"https://o3.security/vulnerability/CVE-2026-34403","summary":"Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints","details":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.","published":"2026-04-20T20:16:47.597Z","modified":"2026-08-05T03:32:32.644446184Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/0xJacky/Nginx-UI","fixedVersion":"1.9.10-0.20260316053337-1a9cd29a3082"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5"},{"type":"ADVISORY","url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34403.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34403"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-05T03:32:32.644446184Z"}}