High severity8.1NVD Advisory· Published Oct 12, 2026

CVE-2026-109286

Description

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

Affected products

Openwebui/Open Webuillm-fuzzy
Range: 0.7.0 - 0.11.4

Patches

Vulnerability mechanics

References

github.com/open-webui/open-webui/security/advisories/GHSA-vpq8-f445-hcq7nvd
www.vulncheck.com/advisories/open-webui-0.7.0-before-0.11.4-session-token-theft-via-syncstatsmodalnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000