CVE-2026-34403 - Vulnerability Analysis

Overview

Nginx UI < 2.3.5 contains a stored XSS caused by insecure WebSocket origin checks and cookie handling, letting attackers hijack authenticated WebSocket connections via malicious webpages, exploit requires victim administrator to visit attacker page.

Severity & Score

Impact

Attackers can hijack authenticated WebSocket connections, potentially leading to unauthorized actions as an administrator.

Mitigation

Upgrade to version 2.3.5 or later.

References

• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner