Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies… (CVE-2026-109292)

The Open WebUI software versions starting from 0.6.27 and before 0.11.4 have an information disclosure vulnerability (CVE-2026-109292) where destination servers can receive the full browser cookie jar on OAuth-mode connections. This flaw allows malicious operators of OpenAI-compatible connections, OpenAPI tool servers, or terminal servers to capture forwarded session cookies from routine requests. These captured cookies can then be replayed to hijack user accounts, including administrators. The vulnerability has a CVSS v3.1 score of 6.8, indicating a high severity with network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

The vulnerability allows unauthorized disclosure of user session cookies to destination servers during OAuth-mode connections. Attackers controlling these destination servers can capture and replay session cookies to hijack user accounts, including those with administrative rights. This compromises confidentiality and integrity of user sessions but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, users should exercise caution when connecting to untrusted destination servers in OAuth mode and consider limiting exposure of session cookies where possible.