What is the CVSS score of CVE-2026-59224?

CVE-2026-59224 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Open WebUI are affected by CVE-2026-59224?

Open WebUI versions before 0.10.0 contain an identity spoofing vulnerability allowing authenticated users to hijack other users' terminal sessions and gain unauthorized access to sensitive…. A patch is available.

How to fix or mitigate CVE-2026-59224?

Within 24 hours: Identify all Open WebUI instances and document current versions. Within 7 days: Deploy Open WebUI v0.10.0 or later to all systems. Within 30 days: Review terminal session access logs covering 90 days prior to patching to identify unauthorized session activity.

Open WebUI CVE-2026-59224

EUVD-2026-42636 HIGH

Improper Authentication (CWE-287)

2026-07-09 security-advisories@github.com

GHSA-j657-m4c4-24jq

Authentication Bypass Open Webui

8.0

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable identity spoof needing a low-privileged account (PR:L) and non-trivial injection crafting (AC:H); crossing into another user's identity is a scope change (S:C) with full C/I/A impact on the victim's terminal session.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:35 vuln.today

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.

AnalysisAI

Identity spoofing in Open WebUI before 0.10.0 lets an authenticated low-privileged user impersonate another account by injecting query parameters into the terminal WebSocket URL. Because backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter - while the HTTP proxy path trusted an integrity-unbound X-User-Id header - an attacker can make the terminal backend resolve a different user identity, gaining that victim's terminal session context. No public exploit has been identified at time of analysis, but the fix is confirmed in v0.10.0 and the flaw is scored CVSS 8.0.

Technical ContextAI

Open WebUI is a self-hosted, extensible AI/LLM front-end (Python FastAPI backend, Svelte frontend) that includes an interactive terminal feature. The vulnerability lives in the terminal proxy layer: the backend constructs the upstream WebSocket URL for ws_terminal by string-concatenating a session_id that is never URL-encoded, then appends the caller's user_id as a query-string parameter. An attacker-controlled session_id containing URL delimiters (e.g. '&' or an additional 'user_id=' pair) therefore performs classic query-parameter injection, causing the backend to parse an attacker-chosen user_id and bind the terminal to another identity. Compounding this, the parallel HTTP proxy path forwards an X-User-Id header treated as a trusted identity claim without any cryptographic or session binding. This is a CWE-287 (Improper Authentication) issue - identity is derived from client-supplied, unauthenticated request data rather than a verified server-side session.

RemediationAI

Vendor-released patch: upgrade to Open WebUI 0.10.0 or later, which URL-encodes session identifiers and stops trusting the client-supplied X-User-Id claim (see advisory https://github.com/open-webui/open-webui/security/advisories/GHSA-j657-m4c4-24jq and release https://github.com/open-webui/open-webui/releases/tag/v0.10.0). If you cannot upgrade immediately, disable or restrict the terminal feature so untrusted or low-privileged users cannot invoke ws_terminal, and place the instance behind a reverse proxy that strips or overrides any inbound X-User-Id header rather than forwarding it upstream - the trade-offs are loss of terminal functionality for affected users and added proxy configuration overhead. For multi-tenant instances, limit the platform to trusted users until patched, since the identity-spoofing path only matters where multiple distinct user identities exist. The fix corresponds to commit 5f3a628 (PR #26042).