Cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

Open WebUI is vulnerable to stored cross-site scripting (XSS) via OAuth profile picture handling, allowing an attacker to inject malicious SVG code and potentially takeover user accounts by exfiltrating JWT tokens.