Cross-Origin Message Handling Vulnerability in Open WebUI

Open WebUI versions 0.7.0 through 0.11.3 are vulnerable to a cross-origin message handling flaw in the SyncStatsModal component. The application fails to validate the origin or content of incoming postMessage events, specifically those targeting the SyncStatsModal. An attacker can craft a malicious website that sends an unvalidated 'verify:chat' message to a user currently authenticated to the Open WebUI instance. By supplying a path-traversal chat ID within this message, the attacker redirects the application's authenticated stats export request to the /auths endpoint. This interaction causes the application to export the victim's session JSON Web Token (JWT) back to the attacker-controlled origin, facilitating full unauthorized API access to the victim's account. This vulnerability poses a significant risk to organizations relying on Open WebUI for internal AI chat services.

Impact

Successful exploitation allows for full account takeover of authenticated users. An attacker gaining the session JWT can perform any action the user is authorized to perform, including reading chat history, accessing LLM configurations, and modifying system settings. This risk is particularly high for enterprise deployments where users may have elevated privileges or access to sensitive internal documents.

Recommendation

• Upgrade Open WebUI to version 0.11.4 or later immediately.
• Review access logs for unusual patterns of API access originating from unfamiliar origins or non-standard user-agent strings.
• Patch CVE-2026-109286 on all internet-facing or internal-facing instances as the highest priority.