High severity7.3NVD Advisory· Published Jul 15, 2026· Updated Jul 16, 2026
CVE-2026-56398
CVE-2026-56398
Description
Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.
Affected products
2cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: <0.9.5
- (no CPE)range: <0.9.5
Patches
Vulnerability mechanics
References
2- github.com/open-webui/open-webui/security/advisories/GHSA-3wgj-c2hg-vm6qnvdExploitVendor Advisory
- www.vulncheck.com/advisories/open-webui-stored-cross-site-scripting-via-oauth-picture-claim-svg-data-urinvdThird Party Advisory
News mentions
0No linked articles in our index yet.