Description
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-webui | open-webui | 0.7.0 – < 0.11.4 | 0.11.4 |
References
- GitHub Security Advisory (GHSA-vpq8-f445-hcq7) vendor-advisory
- VulnCheck Advisory: Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal third-party-advisory