Medium severity6.8NVD Advisory· Published Oct 12, 2026
CVE-2026-109292
CVE-2026-109292
Description
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 0.6.27 - 0.11.4
Patches
Vulnerability mechanics
References
5- github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807nvd
- github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23nvd
- github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79nvd
- github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rpnvd
- www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connectionsnvd
News mentions
0No linked articles in our index yet.