CVE-2026-109286 in Open WebUI
Zusammenfassung
von MITRE • 12.10.2026
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.