CVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows…
- Risk score
- 48/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwa…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.11.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
- https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807
- https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23
- https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79
- https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp
- https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections
- https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp
Original description
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Last activity 12 Oct 2026. Patch Forecast updates every hour.