CVE-2026-109292
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
- State
- Published
- Severity
- 7.6 High
- Published
- Oct 12, 2026
- Updated
- Oct 23, 2026
- Reserved
- Oct 12, 2026
Description
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.6 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
open-webuiopen-webui |
|
References
- GitHub Security Advisory (GHSA-gqfh-jxvw-74rp)vendor-advisory
- Patch Commitpatch
- Patch Commitpatch
- Patch Commitpatch
- VulnCheck Advisory: Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connectionsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.