CVE-2026-109286: Open WebUI session token theft

CISO Take

Open WebUI versions 0.7.0 through 0.11.3 accept unvalidated cross-origin verify:chat messages in the SyncStatsModal component, so any website a signed-in user visits can make their browser send an authenticated request to the auths endpoint and hand back the user's JWT. A path-traversal chat id is what redirects the stats export call there, giving the attacker full API access as the victim, including admins. The CVSS is 8.1 with no privileges required, but the user must visit a malicious page, and there is no public exploit, Nuclei template, or KEV listing, and EPSS is not yet available. Only 3 downstream dependents are tracked, but Open WebUI is a widely self-hosted front end for internal LLMs, and the package has 186 other CVEs, so exposure is mainly about internal deployments holding chat history, API keys, and model connections. Upgrade to 0.11.4 or later, invalidate existing sessions where compromise is suspected, and check access logs for unusual requests to the auths endpoint originating from cross-origin referrers.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High. The attack is network-reachable with low complexity and needs no privileges, but requires one user interaction (visiting an attacker-controlled page). Impact is high for confidentiality and integrity because a stolen JWT grants full API access as the victim. Admin sessions raise the risk further. No known exploitation, public PoC, or scanner template at publication, and EPSS is unavailable, so likelihood is currently unquantified. Targeted phishing against known Open WebUI operators is the realistic path.

How does the attack unfold?

Initial Access

Victim who is signed in to Open WebUI visits an attacker-controlled website that interacts with the Open WebUI origin.

AML.T0078

Exploitation

The site posts an unvalidated verify:chat message with a path-traversal chat id, redirecting the authenticated stats export request to the auths endpoint.

AML.T0049

Credential Theft

The auths endpoint response containing the victim's JWT is returned to the attacker.

AML.T0091.000

Impact

The attacker uses the JWT for full API access, reading chats and knowledge bases and abusing connected LLM providers.

AML.T0012

Initial Access

Victim who is signed in to Open WebUI visits an attacker-controlled website that interacts with the Open WebUI origin.

AML.T0078

Exploitation

The site posts an unvalidated verify:chat message with a path-traversal chat id, redirecting the authenticated stats export request to the auths endpoint.

AML.T0049

Credential Theft

The auths endpoint response containing the victim's JWT is returned to the attacker.

AML.T0091.000

Impact

The attacker uses the JWT for full API access, reading chats and knowledge bases and abusing connected LLM providers.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade Open WebUI to 0.11.4 or later. 2) If patching is delayed, restrict access to the instance to a VPN or trusted network and avoid browsing untrusted sites in the same browser session as the Open WebUI login. 3) Rotate the JWT secret (WEBUI_SECRET_KEY) to invalidate all existing sessions after upgrading if compromise is suspected. 4) Review reverse proxy and application logs for requests to the auths endpoint or stats export paths containing path-traversal sequences (../) in the chat id. 5) Audit admin accounts, API keys, and connected model provider keys for unauthorized use. 6) Consider a restrictive Content Security Policy and SameSite cookie/token handling at the reverse proxy.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0078- Drive-by Compromise AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-109286?

Open WebUI versions 0.7.0 through 0.11.3 accept unvalidated cross-origin verify:chat messages in the SyncStatsModal component, so any website a signed-in user visits can make their browser send an authenticated request to the auths endpoint and hand back the user's JWT. A path-traversal chat id is what redirects the stats export call there, giving the attacker full API access as the victim, including admins. The CVSS is 8.1 with no privileges required, but the user must visit a malicious page, and there is no public exploit, Nuclei template, or KEV listing, and EPSS is not yet available. Only 3 downstream dependents are tracked, but Open WebUI is a widely self-hosted front end for internal LLMs, and the package has 186 other CVEs, so exposure is mainly about internal deployments holding chat history, API keys, and model connections. Upgrade to 0.11.4 or later, invalidate existing sessions where compromise is suspected, and check access logs for unusual requests to the auths endpoint originating from cross-origin referrers.

Is CVE-2026-109286 actively exploited?

No confirmed active exploitation of CVE-2026-109286 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109286?

1) Upgrade Open WebUI to 0.11.4 or later. 2) If patching is delayed, restrict access to the instance to a VPN or trusted network and avoid browsing untrusted sites in the same browser session as the Open WebUI login. 3) Rotate the JWT secret (WEBUI_SECRET_KEY) to invalidate all existing sessions after upgrading if compromise is suspected. 4) Review reverse proxy and application logs for requests to the auths endpoint or stats export paths containing path-traversal sequences (../) in the chat id. 5) Audit admin accounts, API keys, and connected model provider keys for unauthorized use. 6) Consider a restrictive Content Security Policy and SameSite cookie/token handling at the reverse proxy.

What systems are affected by CVE-2026-109286?

This vulnerability affects the following AI/ML architecture patterns: LLM chat web interfaces, Self-hosted LLM front ends, RAG pipelines, Model serving gateways.

What is the CVSS score for CVE-2026-109286?

CVE-2026-109286 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

LLM chat web interfacesSelf-hosted LLM front endsRAG pipelinesModel serving gateways

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0078Drive-by Compromise

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

Exploitation Scenario

An attacker identifies an organization running Open WebUI as its internal LLM portal and sends staff a link to a page they control. When a logged-in user opens it, the page opens or embeds the Open WebUI instance and posts a crafted verify:chat message with a chat id such as a path-traversal string pointing to the auths endpoint. SyncStatsModal does not validate the message origin, so the authenticated stats export request is redirected to the auths endpoint and the response containing the victim's JWT is returned to the attacker's page. The attacker then uses the token against the Open WebUI API to read chat history, pull documents from knowledge bases, and use the organization's configured LLM connections.