Executive brief
Open WebUI, a user interface for interacting with large language models, is vulnerable to a security flaw in its login process. An attacker can use a specially crafted profile picture to run malicious scripts in the browsers of other users who view their profile. This could allow the attacker to steal login tokens and take over user accounts, gaining access to private chats and sensitive settings.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Open WebUI's OAuth authentication flow. The application infers the MIME type of a user's profile picture from the URL extension rather than the Content-Type header and fails to apply standard image validation during the OAuth signup/login path. This allows an attacker to provide an SVG file that is stored as a data URI in the database. When an authenticated victim views the attacker's profile image endpoint, the server returns the SVG with 'Content-Disposition: inline' and no default security headers (CSP or X-Content-Type-Options). This enables the execution of arbitrary JavaScript in the victim's browser session, allowing the attacker to steal JWT authentication tokens from localStorage. The issue is fixed in version 0.9.5.
Affected products
- open-webui open-webui < 0.9.5
Timeline
- 2026-05-10: advisory: Initial GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD