Product

Open WebUI (>= 0.8.6, < 0.11.4)

1 brief RSS

Cross-Origin Message Handling Vulnerability in Open WebUI

Open WebUI versions 0.7.0 through 0.11.3 contain a cross-origin message handling vulnerability that allows unauthenticated websites to steal a user's session JWT via a crafted postMessage payload.

Open WebUI +2 web-vulnerability cross-origin authentication-bypass api-security privilege-escalation web-application security-update

4t 1c 6h ago