← All reports

The nginx-ui product has a vulnerability that allows Cross-Site WebSocket Hijacking due to an improperly configured WebSocket Upgrader.

CybersecurityTechnologyConflictApr 20, 2026score 0.172 posts · 0 replies across 1 instances
The thread discusses two vulnerabilities in the nginx-ui product, highlighting security risks related to Cross-Site WebSocket Hijacking and unauthorized API token usage. These issues underscore the importance of timely software updates and security practices.

Claims

The nginx-ui product has a vulnerability that allows Cross-Site WebSocket Hijacking due to an improperly configured WebSocket Upgrader.
Parent: CybersecurityEntity: nginx-uiImpact: negativeDate: Apr 20, 2026Target: The security of the nginx-ui product
The nginx-ui product has a vulnerability that allows unauthorized API token usage even after an account is disabled.
Parent: CybersecurityEntity: nginx-uiImpact: negativeDate: Apr 20, 2026Target: The security of the nginx-ui product

Source posts

@[email protected]
🚨 EUVD-2026-23965 📊 Score: 8.6/10 (CVSS v3.1) 📦 Product: nginx-ui 🏢 Vendor: 0xJacky 📅 Updated: 2026-04-20 📝 Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23965 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Apr 20, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-23972 📊 Score: 5.5/10 (CVSS v3.1) 📦 Product: nginx-ui 🏢 Vendor: 0xJacky 📅 Updated: 2026-04-20 📝 Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combine... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23972 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Apr 20, 2026
#cybersecurity#infosec#euvd#cve#vulnerability