Information Disclosure Vulnerability in Open WebUI by OpenAI
CVE-2026-109292

7.6HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109292?

Open WebUI versions prior to 0.11.4, starting from 0.6.27, are susceptible to an information disclosure vulnerability. This issue allows destination servers to gain access to user session cookies through the complete browser cookie jar exposed on OAuth-mode connections. As a result, operators of OpenAI-compatible servers or terminal interfaces can intercept forwarded session cookies from standard requests, enabling them to impersonate users, including those with administrative privileges, through cookie replay attacks.

Affected Version(s)

open-webui 0.6.27 < 0.11.4

open-webui 0.11.4

References

https://github.com/open-webui/open-webui/security/advisor...
vendor-advisory
https://github.com/open-webui/open-webui/commit/f9f815c86...
patch
https://github.com/open-webui/open-webui/commit/b71744b17...
patch

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

gigioneggiando
brodmart
Classic298
.