High priorityDisclosed

Advisory · CVE-2026-109286

Open WebUI cross-origin message flaw steals session tokens

Any website can post unvalidated messages to Open WebUI's SyncStatsModal, redirect an authenticated stats export to the authentication endpoint with a traversal chat id, and receive the signed-in user's JWT for full API access. Fixed in 0.11.4.

Advisory published October 12, 2026Independent summary
Vendor
Open WebUI
Product
Open WebUI
Identifier / CWE
CVE-2026-109286
CWE-346
Action timing
Immediate
ELI5

Explain it like I’m five

The app listens for notes slipped under any door without checking who sent them. One crafted note tells it to hand the visitor's master key out through the mail slot.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Victim signed in

    A user is signed in to a vulnerable Open WebUI instance in their browser.

  2. 02Malicious site visited

    The user visits an attacker-controlled website, which posts a crafted verify chat message to the instance.

  3. 03Message accepted

    The SyncStatsModal component handles the message without validating its origin.

  4. 04Token returned

    A path-traversal chat id redirects the authenticated stats export to the authentication endpoint, and the attacker's site receives the victim's JWT.

What happened

The Open WebUI security advisory for CVE-2026-109286 covers Open WebUI from 0.7.0 before 0.11.4 and rates the flaw CVSS 3.1 8.1.

The SyncStatsModal component accepts cross-origin window messages without validating where they came from. Any website a signed-in user visits can post a crafted message, supply a path-traversal chat id that redirects the authenticated stats export request to the authentication endpoint, and receive the victim’s JWT. That token gives full API access as the victim.

Per the advisory record, 0.11.4 is the fixed release.

What to do

  1. Inventory Open WebUI instances and check each version.
  2. Upgrade affected instances to Open WebUI 0.11.4 or later.
  3. Tell users to avoid unrelated websites while signed in to unpatched instances, and consider restricting instance access by network until upgraded.
  4. Review API logs for token use from unfamiliar locations or user agents.
  5. Invalidate active sessions on instances where suspicious token use is found.
  6. Confirm the deployed version after upgrading.

Management note

No malicious file or password reuse is involved: a routine web visit by any signed-in user can hand over their full session. Shared and team Open WebUI instances should patch ahead of less exposed internal tools.