An authenticated attacker with access to a shared terminal server can host a malicious HTML page on a port. When an unsuspecting user views this port via the Open WebUI terminal preview, the attacker-supplied script executes within the application origin. This permits the script to access localStorage, extract sensitive session tokens, and perform actions on behalf of the victim, leading to full account takeover. The vulnerability persists unless the user has manually configured restrictive Content Security Policy (CSP) headers or utilized a terminal connection with an external URL, which forces a cross-origin boundary.

Attack Chain

1. Attacker obtains authenticated access to a shared terminal server environment managed by the Open WebUI instance.
2. Attacker deploys a malicious HTML file or script on a reachable port within that terminal server environment.
3. Attacker waits for a victim user (potentially an administrator) to open the Open WebUI file navigator.
4. Victim user navigates to the port list and selects the attacker-controlled port for preview.
5. Open WebUI renders the attacker's content within an iframe using the insecure allow-same-origin and allow-scripts sandbox flags.
6. Malicious script executes in the parent application context and accesses window.parent.localStorage.
7. Script exfiltrates the victim's session token to an attacker-controlled external server.
8. Attacker uses the stolen session token to assume the victim's identity and perform unauthorized operations, such as executing server-side code via Functions.

Impact

Successful exploitation results in total account takeover of the victim. If the compromised victim holds administrative privileges or permissions related to workspace.functions, the attacker can escalate to server-side code execution. The attack is limited to deployments where TERMINAL_SERVER_CONNECTIONS are configured and shared between users.

Recommendation

Upgrade Open WebUI to version 0.11.1 or later immediately to resolve CVE-2026-87995. Ensure that the terminalPreviewAllowSameOrigin user setting remains disabled, which is the default behavior in the patched version. For administrators who cannot upgrade immediately, verify that a restrictive Content Security Policy (CSP) is applied via the TERMINAL_PROXY_HEADERS configuration to mitigate the risk of script exfiltration.