CVE-2026-109292

EUVD-2026-97594
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807
https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23
https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79
https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp
https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections