CVE-2026-109286 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Open WebUI versions prior to 0.11.4 represents a critical cross-origin message handling flaw located within the SyncStatsModal component. This issue stems from an insufficient validation of incoming postMessage events, specifically those carrying verify:chat payloads. In modern web applications that utilize the window.postMessage API for inter-frame communication, it is imperative that the origin of the sender be strictly validated before processing any sensitive data or executing privileged actions. The absence of such checks in this specific modal allows malicious websites to inject crafted messages into the application context when a user with an active session visits a compromised page. This architectural oversight effectively bypasses standard same-origin policy protections, enabling cross-site scripting-like attacks that do not rely on injecting executable code but rather on manipulating legitimate message handlers.
The operational impact of this vulnerability is severe due to its direct consequence on authentication integrity. An attacker can exploit the unvalidated message handler by supplying a chat identifier that contains path-traversal sequences. This manipulation tricks the application into redirecting an authenticated statistics export request toward internal or administrative endpoints, specifically targeting the auths endpoint. By doing so, the attacker forces the browser to send requests containing the victim's valid JSON Web Token (JWT) to locations where such tokens are not typically exposed during normal user interactions. The result is the exfiltration of the session token, which grants the adversary full API access equivalent to that of the compromised user. This level of access allows for unauthorized data retrieval, modification, or deletion depending on the permissions associated with the victim's account.
From a classification perspective, this vulnerability aligns closely with CWE-942, which describes Cross-Origin PostMessage Abuse due to insufficient validation of message origin and content. It also maps to MITRE ATT&CK technique T1530, Data from Local System, as it involves stealing credentials stored in the browser's memory or local storage via a web-based attack vector. The specific mechanism of using path traversal within a chat ID parameter highlights CWE-22, Improper Limitation of a Pathname to a Restricted Directory, although its primary function here is to redirect API calls rather than access file system resources directly. This combination of flaws illustrates how seemingly minor input validation errors in complex single-page applications can lead to significant security breaches by leveraging the application's own trusted communication channels against it.
Mitigation strategies must focus on implementing strict origin verification for all postMessage listeners and sanitizing inputs that influence API routing logic. Developers should ensure that only messages originating from explicitly whitelisted domains are processed, rejecting any others immediately. Additionally, input validation mechanisms must be strengthened to detect and neutralize path-traversal attempts within parameters like chat IDs before they reach backend services or internal handlers. Upgrading Open WebUI to version 0.11.4 or later is the primary remediation step as it addresses these specific flaws in the SyncStatsModal component. For organizations unable to upgrade immediately, deploying a web application firewall with rules capable of detecting anomalous postMessage patterns and path-traversal sequences can provide an additional layer of defense against exploitation attempts targeting this vulnerability.