CVE-2026-109286
Received Received - Intake

Cross-Site Request Forgery in Open WebUI Session Token Handling

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109286
EUVD
EUVD-2026-97588

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WebUI versions 0.7.0 to 0.11.4 have a vulnerability where a website can steal a logged-in user's session token by sending unvalidated messages. Attackers exploit this by tricking the app into redirecting an authenticated request to a malicious endpoint, allowing them to obtain the user's JWT for full API access.

Detection Guidance

Check Open WebUI version with: docker inspect open-webui | grep -i version or visit /version endpoint. If running 0.7.0 to 0.11.3, the system is vulnerable. Monitor browser console for unexpected window.postMessage events or unauthorized API calls.

Impact Analysis

If you use Open WebUI versions 0.7.0 to 0.11.4, an attacker could gain full access to your account and data. They might steal sensitive information, modify settings, or perform actions on your behalf without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance breaches and legal consequences.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later immediately. Disable community sharing feature if not required. Review API access logs for suspicious activity. Rotate all exposed JWT tokens and session cookies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart