The vulnerability in nginx-ui versions before 2.3.5 stems from missing origin validation in WebSocket connections, specifically the gorilla/websocket Upgrader's CheckOrigin function unconditionally returning true. This flaw permits Cross-Site WebSocket Hijacking attacks. Because authentication tokens are stored in cookies accessible via JavaScript and lack HttpOnly and SameSite attributes, an attacker can leverage a malicious webpage to initiate authenticated WebSocket sessions as an administrator. The issue is fixed in version 2.3.5.

An attacker can exploit this vulnerability to hijack authenticated WebSocket sessions of an administrator by tricking them into visiting a malicious webpage. This can lead to unauthorized actions performed with administrator privileges via the WebSocket interface. The CVSS 4.0 score is 5.5 (medium severity), reflecting network attack vector, no privileges required, user interaction needed, and high impact on integrity via hijacked WebSocket connections.

Upgrade nginx-ui to version 2.3.5 or later, where the origin validation issue in WebSocket endpoints is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official sources. Avoid relying on partial mitigations as the vulnerability involves authentication token handling and origin checks.