Any website can steal a signed-in user's session token via the community stats message handler

Any website can steal a signed-in user's session token via the community stats message handler

Summary

The sync stats modal registered a window message listener that processed verify:chat messages from any web origin without checking event.origin, and replied to window.opener with target origin *. The chat id from the message was inserted into an authenticated request URL without encoding. Any external website that a signed-in user visits can therefore make that user's browser fetch a chosen authenticated endpoint and hand the response, including the user's session token, back to the attacker. No attacker account and no administrator action are required.

Preconditions

• Community sharing enabled (ENABLE_COMMUNITY_SHARING, default True), which is what mounts the sync stats modal and its message listener.
• The victim is signed in to Open WebUI in the same browser and visits an attacker-controlled page that opens Open WebUI in a popup. Deployments with community sharing disabled are not affected.

Impact

The attacker page posts a verify:chat message carrying a path-traversal chat id such as . The listener passes it unencoded into , which the browser normalises to and sends with the victim's bearer token. The listener then posts the response back to the opener with target origin , so the attacker origin receives the victim's identity and raw JWT. That token replays from any client with only an header, granting full API access as the victim: private chats and any authenticated action under the victim's role. The demonstrated victim held the ordinary role.