Executive brief
Open WebUI's port preview feature renders content from a terminal server in an iframe that incorrectly grants same-origin access to the application. An authenticated attacker with terminal access can serve malicious HTML that reads the victim's session token from browser storage and takes over their account. If the victim is an administrator, this escalates to full server compromise including code execution.
Technical details
This is a same-origin XSS vulnerability in the port preview iframe component (PortPreview.svelte). The iframe sandbox attribute was hardcoded to include both `allow-scripts` and `allow-same-origin`, which eliminates isolation since content is served from the application's own origin. An authenticated attacker with access to a shared terminal server (configured by an admin) can start a process listening on any port and serve an HTML page containing JavaScript that reads `window.parent.localStorage.token` and exfiltrates it to an attacker-controlled host. When a victim clicks to preview the attacker's port in the file navigator, the malicious script executes in the application origin and can access the parent window, session tokens, and user data. The vulnerability requires: (1) at least one terminal server configured and reachable by both attacker and victim, (2) an authenticated account on that terminal, (3) victim user interaction (clicking the port preview), and (4) default configuration (no custom Content-Security-Policy). Fixed in version 0.11.1 by making `allow-same-origin` opt-in via a `terminalPreviewAllowSameOrigin` user setting that defaults to off.
Affected products
- Open WebUI Open WebUI 0.8.11 through 0.11.0
Timeline
- 2026-09-10: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-09-10: patched: Fix released in version 0.11.1 with commit 54d7a223
- 2026-09-09: advisory: Vulnerability added to NVD