EUVD-2026-75174
GHSA-p78m-89r6-pgf7
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
AV:N for network-accessible attacker server; AC:H for specific multi-server mixed-auth configuration requirement; PR:N as attacker controls only a third-party tool server; UI:R for victim-initiated tool call; C:H/I:H for full session takeover; A:N as no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.
AnalysisAI
Session cookie leakage in Open WebUI versions 0.6.27 through 0.11.0 allows an attacker who operates a connected tool server to capture a victim user's Open WebUI session cookies and achieve full account takeover. The root cause is a Python closure-in-loop bug in tools.py where a shared cookie jar from the enclosing async loop was captured by all tool callable functions instead of being bound per-function; when a session- or OAuth-authenticated tool server was processed last in the initialization loop, its cookies were incorrectly propagated into requests directed at other attached servers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to have configured at minimum two external tool servers in Open WebUI simultaneously: one that uses session or system OAuth authentication (which causes cookies to be captured in the shared closure) and one controlled by the attacker configured for bearer authentication (which receives the leaked cookies as an unintended recipient). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N scoring 6.8 (Medium) appropriately reflects the exploitation complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Open WebUI version 0.11.1 or later, available at https://github.com/open-webui/open-webui/releases/tag/v0.11.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today