Based on the description, it is inferred that the likely attack vector involves a malicious webpage establishing a WebSocket connection to nginx‑UI. The flaw arises from nginx‑UI’s WebSocket endpoints using a gorilla/websocket Upgrader that unconditionally accepts any Origin header, effectively disabling origin validation. Consequently, a malicious webpage can open a WebSocket connection to an nginx‑UI instance and, if an administrator is already logged in, the browser will automatically supply the authentication cookie. Because this cookie is set via JavaScript without HttpOnly or SameSite attributes, client‑side scripts can also read it, allowing the attacker to impersonate the administrator and perform any action the legitimate user could, including altering configuration or uploading files.

The vulnerability affects the nginx‑UI web user interface developed by 0xJacky. All releases prior to version 2.3.5 are vulnerable; the issue was fixed in release 2.3.5 and later.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% and the fact that the vulnerability is not listed in CISA’s KEV catalog suggest limited exploitation to date. Exploitation requires an administrator who is logged into the nginx‑UI to visit a malicious page; the attacker only needs to serve a crafted web page, making it a client‑side attack that can be launched from any network reachable by the victim’s browser. The absence of HttpOnly or SameSite attributes in the authentication cookie further lowers the barrier to exploitation, but the overall risk remains moderate until the fix is applied.