Open WebUI CVE-2026-87995

Three conditions must hold simultaneously: (1) the attacker must be authenticated to the Open WebUI instance as any low-privilege user; (2) the deployment must use a shared terminal server feature - single-user or non-terminal deployments are not affected; (3) a victim user must open the attacker-controlled port preview tab in their browser. Additionally, the deployment must be running Open WebUI 0.8.11 through 0.11.0, or running 0.11.1 with the terminalPreviewAllowSameOrigin setting left at its default enabled state. Limiting factors: requires an authenticated session (no anonymous exploitation), requires UI interaction by the victim, and is scoped to deployments with shared terminal server access enabled - purely single-user or non-terminal Open WebUI installations are not exposed.

The provided CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N scores 8.7, reflecting that exploitation requires attacker authentication (PR:L), victim interaction (opening the preview tab, UI:R), and a shared terminal server deployment context. Real-world risk is meaningfully constrained by these conditions: this is not a mass-exploitation scenario but rather a targeted attack within a shared multi-user deployment - an uncommon but not rare configuration for team-based Open WebUI instances. The scope change (S:C) is appropriate because the attacker's low-privilege context escalates into full control of the victim's account. EPSS data is absent from the provided inputs. No KEV listing and no POC code is referenced. Critically, the fix in 0.11.1 adds a user-configurable toggle (terminalPreviewAllowSameOrigin) but defaults it to true, meaning the insecure same-origin sandbox attribute remains active after upgrading unless administrators explicitly disable it in Interface Settings - this substantially weakens the effective patch and must be communicated to operators.

An attacker authenticated to a shared Open WebUI instance starts a minimal HTTP server on a previewed port that serves a JavaScript payload - for example, a script that exfiltrates the victim's session token from localStorage. When an admin or higher-privileged user opens the port preview tab in the same Open WebUI deployment, the iframe loads the attacker's page from the same origin with full script execution rights, exfiltrating credentials and completing account takeover silently.