CVE-2026-109292

MEDIUM 6.8

Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

CWE	CWE-200
Vendor	open-webui
Product	open-webui
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for open-webui open-webui

Be the first to know when new medium vulnerabilities affecting open-webui open-webui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

open-webui / open-webui

0.6.27 < 0.11.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp github.com: https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79 github.com: https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23 github.com: https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807 vulncheck.com: https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections

Credits

🔍 gigioneggiando 🔍 brodmart Classic298