CVE-2026-87015

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.

Traduire en français

Produits concernés

• open-webui
• Openwebui open webui

Scores CVSS

Faiblesses (CWE)

• CWE-201

Références

• https://github.com/open-webui/open-webui/commit/cd9db21c5276807a2975ddba17cef369ad1114b7 Patch
• https://github.com/open-webui/open-webui/pull/28630 Issue TrackingPatch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.1 Release Notes
• https://github.com/open-webui/open-webui/security/advisories/GHSA-p78m-89r6-pgf7 ExploitVendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-p78m-89r6-pgf7 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories