# CVE-2026-87995: Open WebUI account takeover via port preview iframe sandbox bypass

Source: https://junglewise.ai/threats/cve-2026-87995-open-webui-account-takeover-via-port-preview-iframe-sandbox  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-87995 · Severity: high · CVSS 8.7 · Published 2026-09-09

Open WebUI's port preview feature renders content from a terminal server in an iframe that incorrectly grants same-origin access to the application. An authenticated attacker with terminal access can serve malicious HTML that reads the victim's session token from browser storage and takes over their account. If the victim is an administrator, this escalates to full server compromise including code execution.

Technologies: [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-87995 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87995 being exploited in the wild.

**How severe is CVE-2026-87995?** High severity, with a CVSS score of 8.7, published 9 September 2026.

**Which products and versions are affected?** open-webui (PyPI) >= 0.8.11, <= 0.11.0, ECOSYSTEM:introduced=0.8.11,fixed=0.11.1.

**Is there a fix for CVE-2026-87995?** Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87995 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87995?** Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-webui (PyPI): upgrade to 0.11.1 or later

  ```sh
  pip install "open-webui>=0.11.1"
  ```


## Technical details

This is a same-origin XSS vulnerability in the port preview iframe component (PortPreview.svelte). The iframe sandbox attribute was hardcoded to include both `allow-scripts` and `allow-same-origin`, which eliminates isolation since content is served from the application's own origin. An authenticated attacker with access to a shared terminal server (configured by an admin) can start a process listening on any port and serve an HTML page containing JavaScript that reads `window.parent.localStorage.token` and exfiltrates it to an attacker-controlled host. When a victim clicks to preview the attacker's port in the file navigator, the malicious script executes in the application origin and can access the parent window, session tokens, and user data. The vulnerability requires: (1) at least one terminal server configured and reachable by both attacker and victim, (2) an authenticated account on that terminal, (3) victim user interaction (clicking the port preview), and (4) default configuration (no custom Content-Security-Policy). Fixed in version 0.11.1 by making `allow-same-origin` opt-in via a `terminalPreviewAllowSameOrigin` user setting that defaults to off.

## Affected products

- Open WebUI Open WebUI 0.8.11 through 0.11.0

## Identifiers

- CVE-2026-87995
- GHSA-jmc6-2wr8-h3wj
- PYSEC-2026-4123

## Timeline

- 2026-09-10: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-09-10: patched: Fix released in version 0.11.1 with commit 54d7a223
- 2026-09-09: advisory: Vulnerability added to NVD

## References

- [https://api.github.com/users/manus-use](https://api.github.com/users/manus-use)
- [https://github.com/manus-use](https://github.com/manus-use)
- [https://api.github.com/users/manus-use/gists%7B/gist_id%7D](https://api.github.com/users/manus-use/gists%7B/gist_id%7D)
- [https://api.github.com/users/manus-use/repos](https://api.github.com/users/manus-use/repos)
- [https://avatars.githubusercontent.com/u/213290975?v=4](https://avatars.githubusercontent.com/u/213290975?v=4)
- [https://api.github.com/users/manus-use/events%7B/privacy%7D](https://api.github.com/users/manus-use/events%7B/privacy%7D)

## Related threats

- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88006-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88005-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI infinite loop denial of service in chat history reconstruction](https://junglewise.ai/threats/cve-2026-88002-open-webui-infinite-loop-denial-of-service-in-chat-history)
- [Open WebUI server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-88001-open-webui-server-side-request-forgery-via-unvalidated-http)
- [Open WebUI denial of service via cyclic chat tree message deletion](https://junglewise.ai/threats/cve-2026-88000-open-webui-denial-of-service-via-cyclic-chat-tree-message)