CVE-2026-109292 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Open WebUI versions prior to 0.11.4 represents a critical information disclosure flaw rooted in the improper handling of authentication credentials during OAuth-based integrations. Specifically, when users connect to external services such as OpenAI-compatible endpoints, OpenAPI tool servers, or terminal servers via OAuth mode, the application inadvertently transmits the complete browser cookie jar to these destination servers. This behavior deviates from standard security practices where only specific tokens required for authentication should be exchanged during an authorization flow. Instead of isolating the necessary access credentials, the software exposes a comprehensive set of cookies that may include session identifiers, tracking data, and potentially sensitive administrative tokens associated with the user's current browser context.
From a technical perspective, this flaw constitutes a severe breach of confidentiality due to the excessive exposure of stateful information. The mechanism allows any server configured as an OAuth destination to intercept these forwarded requests and extract the full suite of cookies stored in the client's browser environment. This is particularly dangerous because session cookies are often long-lived or carry high privileges, serving as the primary means for maintaining authenticated sessions across web applications. By capturing this data, a malicious actor controlling the destination server can perform credential harvesting on a massive scale without requiring any direct interaction from the victim beyond initiating the connection to the compromised service.
The operational impact of this vulnerability is significant, enabling account hijacking and privilege escalation attacks against both standard users and system administrators. An attacker who controls or compromises one of these connected services can replay the captured session cookies to impersonate legitimate users on their original platforms. This capability bypasses multi-factor authentication mechanisms that rely solely on cookie validity rather than additional verification steps at each request, as the stolen cookies effectively authenticate the user's identity directly with the target service. For administrators, this poses an existential threat to organizational security posture, as gaining access to administrative accounts can lead to full system compromise, data exfiltration, and further lateral movement within internal networks.
This vulnerability aligns closely with CWE-200, which defines Information Exposure, specifically falling under categories related to the leakage of sensitive information through improper configuration or logic errors in authentication flows. In terms of offensive security frameworks, this behavior facilitates techniques associated with MITRE ATT&CK T1539, Steal Web Session Cookie, and potentially T1078, Valid Accounts, as it allows attackers to leverage stolen credentials for unauthorized access. The attack vector is primarily remote but requires the victim to interact with a malicious or compromised third-party service that has been integrated into their Open WebUI instance, making social engineering or supply chain compromise potential prerequisites for exploitation in many scenarios.
Mitigation strategies must focus on immediate remediation and architectural review. Organizations running affected versions of Open WebUI should upgrade immediately to version 0.11.4 or later, where this flaw has been addressed by restricting the data transmitted during OAuth handshakes to only those tokens strictly necessary for authentication. Until an update is applied, administrators should audit all connected services and remove any integrations with untrusted or potentially compromised endpoints that request excessive permissions. Additionally, implementing strict Content Security Policy headers and reviewing OAuth scope configurations can help limit the blast radius of such exposures in future deployments. Regular rotation of session tokens and enforcing short-lived sessions further reduces the window of opportunity for attackers to replay stolen credentials effectively.