CVE-2026-109292
Received Received - Intake

Open WebUI Session Cookie Disclosure via OAuth

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109292
EUVD
EUVD-2026-97594

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.6.27

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WebUI versions 0.6.27 to 0.11.3 have a flaw where OAuth-mode connections improperly forward the full browser cookie jar to destination servers. This includes session cookies that can be replayed to hijack accounts, including admin accounts. The issue was fixed in version 0.11.4 by adding a configurable cookie forwarding setting.

Detection Guidance

Check Open WebUI version with: curl -s http://localhost:8080/api/version | grep version. If version is between 0.6.27 and 0.11.3, the system is vulnerable. Inspect network traffic for outbound requests from Open WebUI to external servers containing session cookies.

Impact Analysis

If you use Open WebUI with OAuth-mode connections, your session cookies could be sent to and captured by destination servers. Attackers controlling these servers can replay these cookies to gain full access to your account, including administrative privileges if you are an admin.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA due to unauthorized disclosure of session cookies containing sensitive user data. It enables account hijacking, which could lead to unauthorized access to personal or protected health information.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later. Disable cookie forwarding in all connections by setting forward_cookies to false in connection configurations. Review all OpenAI-compatible, tool server, and terminal server connections for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart