CVE-2026-56398: Open WebUI OAuth avatar stored XSS

CISO Take

Open WebUI's OAuth login flow lets an attacker plant a malicious SVG as a user's profile picture by exploiting a MIME-type check that trusts the file extension in the OAuth picture claim URL instead of the server's actual Content-Type header, so the SVG is stored as a data URI and later served inline with no protective security headers. When any authenticated teammate views that profile image, the SVG's embedded script executes in the same origin as the app, giving the attacker a path to steal session tokens and take over accounts — a real concern because Open WebUI typically sits in front of self-hosted or API-based LLM deployments and often carries admin sessions with access to connected models, API keys, and chat history. There's no evidence of active exploitation: it's not in CISA KEV, has no EPSS score, and no public PoC or Nuclei template exists, and exploitation still requires a victim to view the crafted profile (UI:R) plus low-level privileges (PR:L) — so this isn't an emergency, but Open WebUI already carries 132 other known CVEs against just 4 tracked downstream dependents, a ratio that suggests the package is under-scrutinized relative to how often it's deployed as an LLM front door. Upgrade to Open WebUI 0.9.5 or later, and in the interim restrict which OAuth providers/claims can set arbitrary picture URLs, enforce server-side Content-Type validation (not extension sniffing) on any image fetch, and add Content-Security-Policy plus X-Content-Type-Options: nosniff and Content-Disposition: attachment on the profile image endpoint to prevent inline SVG script execution.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

CVSS 7.3 (high) reflects a network-exploitable, low-complexity flaw with high confidentiality and integrity impact but no availability impact. The main mitigating factors are the requirement for user interaction (a victim must view the attacker's profile image) and low privileges for the attacker to set the claim in the first place. There is no confirmed active exploitation (absent from CISA KEV, no EPSS score published, no public exploit or Nuclei template), which lowers near-term urgency but doesn't reduce severity once triggered — successful exploitation yields full session/token theft and account takeover. Given Open WebUI's role as an authentication-gated LLM gateway and its long history of 132 other CVEs, this should be treated as a high-priority patch rather than a monitor-only item, especially for instances exposing OAuth/OIDC login to external identity providers or self-registration.

How does the attack unfold?

Initial Access

Attacker sets an OAuth identity provider's picture claim to a URL serving SVG content disguised with a benign file extension (e.g. .png).

AML.T0049

Validation Bypass

Open WebUI infers the MIME type from the URL extension instead of the server's Content-Type header, so the SVG passes the profile image validator and is stored as a data URI.

Script Execution

An authenticated user views the attacker's profile, the SVG is served inline with no protective security headers, and its embedded script executes within Open WebUI's origin.

Impact: Account Takeover

The script exfiltrates the victim's session/auth token to an attacker-controlled server, which is replayed to hijack the account and access connected LLM resources.

AML.T0091.000

Initial Access

Attacker sets an OAuth identity provider's picture claim to a URL serving SVG content disguised with a benign file extension (e.g. .png).

AML.T0049

Validation Bypass

Open WebUI infers the MIME type from the URL extension instead of the server's Content-Type header, so the SVG passes the profile image validator and is stored as a data URI.

Script Execution

An authenticated user views the attacker's profile, the SVG is served inline with no protective security headers, and its embedded script executes within Open WebUI's origin.

Impact: Account Takeover

The script exfiltrates the victim's session/auth token to an attacker-controlled server, which is replayed to hijack the account and access connected LLM resources.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
152.6K 3 dependents Pushed 2d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Patch: upgrade to Open WebUI 0.9.5 or later, which fixes the MIME-inference logic for OAuth picture claims. Workarounds if patching is delayed: restrict or disable OAuth providers/claims that let users control arbitrary picture URLs; front the profile image endpoint with a reverse proxy that enforces Content-Type validation server-side (not by file extension) and strips/rejects SVG content; add security headers (Content-Security-Policy with restrictive script-src, X-Content-Type-Options: nosniff, and Content-Disposition: attachment) to any endpoint serving user-uploaded or claim-derived images. Detection: audit logs on the profile image endpoint for SVG content served with inline disposition, monitor for anomalous session token reuse or geographically inconsistent logins following profile image views, and review OAuth identity provider configs for unexpected picture claim values.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Leakage Framework API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-56398?

Open WebUI's OAuth login flow lets an attacker plant a malicious SVG as a user's profile picture by exploiting a MIME-type check that trusts the file extension in the OAuth picture claim URL instead of the server's actual Content-Type header, so the SVG is stored as a data URI and later served inline with no protective security headers. When any authenticated teammate views that profile image, the SVG's embedded script executes in the same origin as the app, giving the attacker a path to steal session tokens and take over accounts — a real concern because Open WebUI typically sits in front of self-hosted or API-based LLM deployments and often carries admin sessions with access to connected models, API keys, and chat history. There's no evidence of active exploitation: it's not in CISA KEV, has no EPSS score, and no public PoC or Nuclei template exists, and exploitation still requires a victim to view the crafted profile (UI:R) plus low-level privileges (PR:L) — so this isn't an emergency, but Open WebUI already carries 132 other known CVEs against just 4 tracked downstream dependents, a ratio that suggests the package is under-scrutinized relative to how often it's deployed as an LLM front door. Upgrade to Open WebUI 0.9.5 or later, and in the interim restrict which OAuth providers/claims can set arbitrary picture URLs, enforce server-side Content-Type validation (not extension sniffing) on any image fetch, and add Content-Security-Policy plus X-Content-Type-Options: nosniff and Content-Disposition: attachment on the profile image endpoint to prevent inline SVG script execution.

Is CVE-2026-56398 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-56398, increasing the risk of exploitation.

How to fix CVE-2026-56398?

Patch: upgrade to Open WebUI 0.9.5 or later, which fixes the MIME-inference logic for OAuth picture claims. Workarounds if patching is delayed: restrict or disable OAuth providers/claims that let users control arbitrary picture URLs; front the profile image endpoint with a reverse proxy that enforces Content-Type validation server-side (not by file extension) and strips/rejects SVG content; add security headers (Content-Security-Policy with restrictive script-src, X-Content-Type-Options: nosniff, and Content-Disposition: attachment) to any endpoint serving user-uploaded or claim-derived images. Detection: audit logs on the profile image endpoint for SVG content served with inline disposition, monitor for anomalous session token reuse or geographically inconsistent logins following profile image views, and review OAuth identity provider configs for unexpected picture claim values.

What systems are affected by CVE-2026-56398?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces / model serving front-ends, OAuth/SSO-integrated web applications, multi-tenant self-hosted LLM gateways.

What is the CVSS score for CVE-2026-56398?

CVE-2026-56398 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

LLM chat interfaces / model serving front-endsOAuth/SSO-integrated web applicationsmulti-tenant self-hosted LLM gateways

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.1

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

Exploitation Scenario

An adversary who controls (or compromises) an OAuth identity provider account — or abuses a self-registration flow where the picture claim is user-controlled — sets their picture claim to a URL that serves SVG content but uses a benign extension like .png. Open WebUI fetches the resource, infers the MIME type from the extension rather than the server's Content-Type header, and stores the SVG as a data URI, bypassing the image validator. When a victim (for example, a workspace admin browsing the user list, or a teammate in a shared chat) later loads the attacker's profile image, the endpoint serves the SVG inline with no restrictive security headers, and its embedded JavaScript executes in the Open WebUI origin. That script exfiltrates the victim's session/auth token to an attacker-controlled server, which the adversary then replays to hijack the account — potentially gaining access to connected LLM API keys, RAG data sources, or admin functions depending on the victim's role.

Weaknesses (CWE)

CWE-20 Improper Input Validation

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.