CVE-2026-34403: Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

April 21, 2026 (updated April 27, 2026)

All WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page.

References

github.com/0xJacky/nginx-ui
github.com/0xJacky/nginx-ui/releases/tag/v2.3.5
github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj
github.com/advisories/GHSA-78mf-482w-62qj
nvd.nist.gov/vuln/detail/CVE-2026-34403

Code Behaviors & Features

Detect and mitigate CVE-2026-34403 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →