Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 21:57
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 15:55
- First seenCVSS 7.6NVD modified 2026-10-12 17:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807
- https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23
- https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79
- https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp
- https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections
- https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp