CVE-2026-109292
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
Published Oct 12, 2026 · updated Oct 15, 2026 · open-webui open-webui
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 12, 2026 · NIST NVD
Detected
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, in
Oct 15, 2026 · NIST NVD
Updated
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, in
Affected
- vendor open-webui open-webuiversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool server
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-109292
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-109292
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool server
nvd.nist.gov