CVE-2026-56398: Open WebUI XSS Vulnerability

CVE-2026-56398 Overview

CVE-2026-56398 is a stored cross-site scripting (XSS) vulnerability in Open WebUI versions before 0.9.5. The flaw resides in the OAuth authentication flow, where the picture claim URL MIME type is inferred from the file extension instead of the HTTP Content-Type header. This logic gap allows Scalable Vector Graphics (SVG) files to bypass the profile image validator and persist as data URIs. When authenticated users load the profile image endpoint, the server returns attacker-controlled SVG content with an inline disposition and no default security headers. The stored payload executes JavaScript in the same origin, enabling authentication token theft and account takeover.

Critical Impact
Attackers can steal authentication tokens and hijack accounts by delivering SVG payloads through the OAuth picture claim, leading to full account takeover in Open WebUI deployments.

Affected Products

Open WebUI versions prior to 0.9.5
Deployments using OAuth authentication with external identity providers
Self-hosted Open WebUI instances exposing the profile image endpoint

Discovery Timeline

2026-07-15 - CVE-2026-56398 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-56398

Vulnerability Analysis

The vulnerability is classified under [CWE-20] Improper Input Validation. Open WebUI processes the OAuth picture claim during authentication and stores the fetched image as a data URI on the user's profile. The validator determines the image MIME type by inspecting the URL file extension rather than the authoritative Content-Type header returned by the remote server. An attacker controlling the OAuth picture URL can host an SVG document behind a URL with an image extension like .png or .jpg, or manipulate the extension logic to deliver SVG content that the validator accepts.

Once stored, the profile image endpoint serves the SVG with an inline Content-Disposition and omits security response headers such as Content-Security-Policy and X-Content-Type-Options. Browsers render the SVG as active content in the Open WebUI origin. Any authenticated user who views the attacker's profile image triggers script execution capable of reading session tokens from local storage or cookies and issuing authenticated API requests.

Root Cause

The root cause is trust in the file extension for MIME type inference. The validator does not enforce a deny list for SVG, does not perform content sniffing, and does not restrict the accepted MIME types returned when serving the stored data URI. The absence of a strict Content Security Policy on the profile image endpoint compounds the flaw by allowing inline script execution.

Attack Vector

The attacker registers or authenticates through an OAuth identity provider and supplies a picture claim URL that resolves to malicious SVG content. Open WebUI stores the payload as a data URI. When a victim, including administrators, loads the endpoint that renders the attacker's profile picture, the browser executes the embedded JavaScript in the Open WebUI origin. The script exfiltrates authentication tokens and can perform account takeover actions on behalf of the victim.

See the GitHub Security Advisory GHSA-3wgj-c2hg-vm6q and the VulnCheck Advisory on Open WebUI for technical details.

Detection Methods for CVE-2026-56398

Indicators of Compromise

Profile records containing data:image/svg+xml URIs or SVG content with <script> tags or on* event handlers
OAuth picture claim URLs pointing to untrusted or newly registered domains delivering SVG payloads
Outbound HTTP requests from user browsers to attacker-controlled domains shortly after loading Open WebUI profile pages
Unexpected session token usage from geolocations or user agents inconsistent with the legitimate account owner

Detection Strategies

Inspect stored profile image fields for MIME types other than image/png, image/jpeg, image/gif, or image/webp
Review web server logs for requests to the profile image endpoint returning image/svg+xml responses
Audit OAuth callback logs for picture claims sourced from domains outside approved identity providers

Monitoring Recommendations

Alert on any profile image responses lacking Content-Security-Policy or containing inline scripts
Monitor for authentication tokens used from multiple IP addresses within short time windows
Track administrative privilege changes and API key generation events immediately following profile page views

How to Mitigate CVE-2026-56398

Immediate Actions Required

Upgrade Open WebUI to version 0.9.5 or later without delay
Rotate all user session tokens and API keys after patching
Audit stored profile images and purge any entries containing SVG data URIs or embedded scripts
Review OAuth provider configuration and restrict the accepted identity providers

Patch Information

The Open WebUI maintainers released version 0.9.5 to remediate CVE-2026-56398. The fix enforces MIME type validation using the HTTP Content-Type header and rejects SVG content in the OAuth picture claim processing path. Refer to the GitHub Security Advisory GHSA-3wgj-c2hg-vm6q for the full patch notes.

Workarounds

Disable OAuth authentication until the upgrade is applied if immediate patching is not possible
Deploy a reverse proxy rule that strips or rewrites Content-Type: image/svg+xml responses from the profile image endpoint
Add a restrictive Content-Security-Policy header disallowing inline scripts on all Open WebUI responses
Restrict OAuth picture claim sources to a trusted allow list of identity provider domains

bash

# Example NGINX configuration to block SVG responses and enforce CSP
location /api/v1/users/ {
    proxy_pass http://openwebui_backend;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:; object-src 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_hide_header Content-Type;
    add_header Content-Type "image/png" always;
}