Stored Cross-Site Scripting Vulnerability in Open WebUI OAuth Authentication

CVE-2026-56398

What is CVE-2026-56398?

Open WebUI versions prior to 0.9.5 are vulnerable to a stored cross-site scripting flaw within the OAuth authentication mechanism. This occurs due to the misinterpretation of the MIME type for picture claim URLs, relying solely on file extensions instead of the Content-Type header. As a consequence, SVG files can evade the profile image validation process and be stored as data URIs. When authenticated users access the profile image endpoint, they may be exposed to attacker-controlled SVG content that executes scripts due to the lack of proper security headers and the inline disposition. This issue can lead to the theft of authentication tokens and risks account takeover for affected users.

References