CVE-2026-56398

9.0 Critique

Publiée le 15/07/2026 à 14:18 · Modifiée le 16/07/2026 à 22:03 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.5 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.3 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`
3.1	9.0 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-20

Références

https://github.com/open-webui/open-webui/security/advisories/GHSA-3wgj-c2hg-vm6q ExploitVendor Advisory
https://www.vulncheck.com/advisories/open-webui-stored-cross-site-scripting-via-oauth-picture-claim-svg-data-uri Third Party Advisory

CVE-2026-56398

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs