CVE-2026-109286: Open WebUI Auth Bypass Vulnerability

CVE-2026-109286 Overview

CVE-2026-109286 is a cross-origin message handling vulnerability in Open WebUI versions 0.7.0 through 0.11.3. The flaw resides in the SyncStatsModal component, which processes postMessage events without validating the sender origin. Any attacker-controlled website visited by a signed-in Open WebUI user can post an unvalidated verify:chat message that triggers an authenticated request. By supplying a path-traversal chat id, the attacker redirects the stats export request to the auths endpoint and receives the victim's JSON Web Token (JWT). The stolen token grants full API access to the victim's Open WebUI account. The weakness is categorized as [CWE-346] Origin Validation Error.

Critical Impact
Cross-origin JWT theft enables full API-level account takeover of authenticated Open WebUI users with a single visit to an attacker-controlled page.

Affected Products

Open WebUI versions 0.7.0 through 0.11.3
Open WebUI SyncStatsModal component
Deployments exposing Open WebUI to authenticated users browsing untrusted sites

Discovery Timeline

2026-10-12 - CVE-2026-109286 published to the National Vulnerability Database
2026-10-15 - Last updated in the NVD database

Technical Details for CVE-2026-109286

Vulnerability Analysis

Open WebUI's SyncStatsModal registers a window.message event listener to receive instructions from embedded or external contexts. The listener does not verify event.origin or event.source before acting on verify:chat messages. Any page loaded in the user's browser can call window.postMessage against an Open WebUI tab and invoke the modal's authenticated workflow. Because the request executes within the victim's browser session, it carries the active session cookie or bearer token.

Root Cause

The root cause is missing origin validation in a cross-document messaging handler. The verify:chat handler accepts a chat id parameter and concatenates it into the URL used for a backend stats export request. Neither the origin nor the path component is sanitized. This design assumption, that only trusted internal callers would reach the handler, is violated by any third-party page in the browser.

Attack Vector

An attacker hosts a malicious page and lures an authenticated Open WebUI user to visit it. The page opens or references the Open WebUI window and sends a crafted verify:chat message containing a path-traversal chat id such as ../auths. The modal issues an authenticated GET request against the traversed path, reaching the auths endpoint that returns the user's JWT. The response is relayed back to the attacker through the same message channel or a secondary exfiltration path. The attacker then uses the JWT to perform any API action the victim can perform. Exploitation requires user interaction, specifically visiting the attacker-controlled page while signed in.

See the GitHub Security Advisory GHSA-vpq8-f445-hcq7 and the VulnCheck Advisory on Session Token Theft for additional technical context.

Detection Methods for CVE-2026-109286

Indicators of Compromise

Server-side access logs showing authenticated requests to /auths or related endpoints with path-traversal sequences such as ..%2F or ../ in the preceding chat id segment.
Unexpected JWT issuance or token-based API calls originating from client sessions shortly after a user browsed external sites.
Browser referrer or Origin headers on sensitive Open WebUI requests that do not match the deployed Open WebUI domain.

Detection Strategies

Hunt web proxy and application logs for requests to Open WebUI chat stats endpoints containing encoded traversal sequences in the chat id path parameter.
Correlate successful auths endpoint reads with session activity from new IP addresses or user agents within a short time window, indicating potential token reuse.
Alert on client-side console errors or Content Security Policy (CSP) violations tied to postMessage traffic on Open WebUI origins.

Monitoring Recommendations

Enable verbose authentication and token issuance logging on the Open WebUI backend and forward logs to a central analytics platform.
Monitor for geographic or ASN mismatches between the user's typical login location and subsequent API calls using the same JWT.
Track user-agent and session fingerprint drift on API calls that follow access to /auths or token-returning endpoints.

How to Mitigate CVE-2026-109286

Immediate Actions Required

Upgrade Open WebUI to version 0.11.4 or later, which contains the fix for the SyncStatsModal origin validation flaw.
Invalidate and rotate all existing user JWTs after upgrading to force reauthentication and revoke any tokens that may have been stolen.
Audit auths endpoint access logs for the vulnerable version window and investigate any requests containing path-traversal patterns.
Communicate the issue to users and advise them to sign out of Open WebUI before browsing untrusted sites until the patch is applied.

Patch Information

The maintainers released a fix in Open WebUI 0.11.4. The patched handler validates event.origin against the deployed Open WebUI origin and rejects chat id values containing path separators or traversal sequences. Refer to the GitHub Security Advisory GHSA-vpq8-f445-hcq7 for the full patch notes.

Workarounds

Restrict Open WebUI access to trusted networks or require VPN access to reduce exposure to drive-by cross-origin attacks.
Deploy a strict Content Security Policy that limits frame-ancestors and controls which origins can embed or interact with the Open WebUI document.
Shorten JWT lifetimes and require reauthentication for sensitive operations to limit the window in which a stolen token is useful.
Instruct users to use a dedicated browser profile for Open WebUI sessions, isolating cookies and tokens from general browsing.

bash

# Configuration example: upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.4
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.4