PT-2026-110709 · Git+1 · Open-Webui
CVSS v4.0
7.6
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions 0.6.27 through 0.11.3
Description
An information disclosure issue exists where destination servers can obtain user session cookies. This occurs during OAuth-mode connections when the full browser cookie jar is received. Operators of terminal servers, OpenAPI tool servers, or OpenAI-compatible connections can capture these forwarded session cookies from routine requests and replay them to hijack accounts, including those with administrator privileges.
Recommendations
Update Open WebUI to version 0.11.4 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open-Webui