{"id":"EUVD-2026-23972","enisaUuid":"a6fcf9e0-6b96-3d02-834e-807ed9f28bae","description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.","datePublished":"Apr 20, 2026, 8:16:47 PM","dateUpdated":"Apr 21, 2026, 1:36:46 PM","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5\n","aliases":"CVE-2026-34403\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"0ef6d60f-1041-3be0-b495-8f563861aa00","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.3.5"}],"enisaIdVendor":[{"id":"731023e6-dbfd-3727-a95f-daf8fbde446d","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"c3b2b85a-3aae-36a5-8e98-7b0e5a2dd88d","vulnerability":{"id":"GHSA-78mf-482w-62qj","description":"Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints","datePublished":"Apr 21, 2026, 3:13:01 PM","dateUpdated":"Apr 27, 2026, 4:20:34 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34403\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5\n","enisa_id":"EUVD-2026-23972\n","aliases":"GHSA-78mf-482w-62qj\nCVE-2026-34403\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"da979473-b052-325a-808e-f0baf7ed3776","vulnerability":{"id":"CVE-2026-34403","description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.","datePublished":"Apr 20, 2026, 8:16:47 PM","dateUpdated":"Apr 21, 2026, 1:36:46 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5\n","enisa_id":"EUVD-2026-23972\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Nov 1, 2026, 7:19:41 AM","vulnerabilityProduct":[{"id":"b6dd5c4b-ce1d-33c0-add8-3a6bb1645ba3","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.3.5"}],"vulnerabilityVendor":[{"id":"09174f56-a805-3050-92b2-20364ed2508b","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}