CVE-2026-109292

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109292

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109292.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109292

Aliases

GHSA-gqfh-jxvw-74rp

Published

2026-10-12T16:04:52Z

Modified

2026-10-13T02:45:48Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

Details

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109292.json"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

918f507d8cdc652ae913b8596877a8a50b845114

Fixed

8bd8b4fac5e059578ac0c74b3c18d11139f88b7d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.6.27"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.6.27

v0.6.28

v0.6.29

v0.6.30

v0.6.31

v0.6.32

v0.6.33

v0.6.34

v0.6.35

v0.6.36

v0.6.37

v0.6.38

v0.6.39

v0.6.40

v0.6.41

v0.6.42

v0.6.43

v0.7.0

v0.7.1

v0.7.2

v0.8.0

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109292.json"