An insecure sandbox configuration in the Open WebUI terminal port preview feature allows authenticated users to execute arbitrary JavaScript in the application's origin, leading to session token theft and account takeover.
Open WebUI +5
web-vulnerability
xss
session-theft
web-application
ssrf
cve-2026-87996
vulnerability
denial-of-service
+5
3r
5t
1c
updated