VYPR
← All advisories
Medium severity6.5OSV Advisory· Published Jan 23, 2026· Updated Jun 17, 2026

CVE-2026-0767

CVE-2026-0767

Description

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-28259.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Openwebui/Open WebuiOSV3 versions
    v0.1.102, v0.1.103, v0.1.104, …+ 2 more
    • (no CPE)range: v0.1.102, v0.1.103, v0.1.104, …
    • cpe:2.3:a:openwebui:open_webui:0.6.32:*:*:*:*:*:*:*
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.