Open WebUI CVE-2026-109286

Exploitation requires that the victim be actively signed into Open WebUI (a valid JWT session must exist) AND that the victim visit or interact with an attacker-controlled web page in the same browser (UI:P / UI:R). The specific technical prerequisite is the SyncStatsModal component accepting cross-origin postMessage 'verify:chat' events without validating the sender origin, combined with its stats-export request accepting a path-traversal chat id that can be redirected to the /auths endpoint. Affected deployments are Open WebUI versions 0.7.0 up to (but not including) 0.11.4. Limiting factors: no server-side authentication is needed by the attacker, but the attack fails if the victim has no active session, does not load the malicious page, or runs a patched build (0.11.4+).

This is a credible, high-priority client-side vulnerability rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H) is internally consistent with the description: an unauthenticated remote attacker (PR:N) uses low-complexity, network-delivered content, but requires passive victim interaction (UI:P) - the signed-in user must merely visit an attacker-controlled web page while their Open WebUI session is active. The CWE-346 (origin validation error) root cause matches the described failure to validate the origin of cross-origin postMessage 'verify:chat' events in SyncStatsModal. The high confidentiality AND integrity impact is justified because the stolen JWT grants 'full API access,' not just data disclosure. Signals are limited: EPSS is not provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' The main mitigating factor is the required user interaction and an active authenticated session, which lowers real-world risk below a fully unauthenticated server-side RCE despite the 8.6 score. Reported by VulnCheck with a vendor GitHub Security Advisory, lending good source credibility.

An attacker lures a user who is currently logged into Open WebUI to a malicious web page. That page uses window.postMessage to send a crafted 'verify:chat' message containing a path-traversal chat id; SyncStatsModal fails to validate the message origin and redirects the authenticated stats-export request to the /auths endpoint, returning the victim's JWT to the attacker's listener. No public POC is referenced, but the attack is low-complexity and requires only that the victim visit the page with an active session.