Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109292Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

Medium 6.8

In plain English

A medium-severity information exposure in open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	0.6.27 – before 0.11.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-gqfh-jxvw-74rp) vendor-advisory
Patch Commit patch
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections third-party-advisory