Executive brief
Open WebUI, a popular interface for large language models, is vulnerable to a security flaw where an attacker can take over other users' accounts. By setting a malicious profile picture through an external login provider (like Google or GitHub), an attacker can trick a victim into clicking a link that steals their login credentials. This could lead to unauthorized access to private chats, API keys, and potentially the ability to execute commands on the server if the victim has administrative permissions.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Open WebUI due to improper validation of the 'picture' claim during OAuth authentication. When a user signs in via OAuth, the application fetches the profile picture URL and uses 'mimetypes.guess_type' to determine the MIME type based on the file extension, bypassing standard Pydantic validators. This allows an attacker to provide an SVG file containing malicious JavaScript. The application then stores this as a base64-encoded data URI and serves it via the '/api/v1/users/{id}/profile/image' endpoint with 'Content-Disposition: inline' and no default Content Security Policy (CSP). An authenticated victim who navigates to this URL will execute the attacker's script in the context of the application's origin, allowing the attacker to steal the victim's JWT from localStorage. This vulnerability is patched in version 0.9.5.
Affected products
- Open WebUI open-webui <= 0.9.4
Timeline
- 2026-05-10: patched: Version 0.9.5 released
- 2026-05-14: advisory: GitHub Advisory GHSA-3wgj-c2hg-vm6q published