{"id":"CVE-2026-109292","kind":"vulnerability","aliases":["CVE-2026-109292","GHSA-gqfh-jxvw-74rp"],"related":[],"title":"Other users' session tokens disclosed via OAuth-mode connections, tool servers and terminals","description":"# Other users' session tokens disclosed via OAuth-mode connections, tool servers and terminals\r\n\r\n## Summary\r\nAn OpenAI-compatible connection, OpenAPI tool server or terminal server configured with the \"OAuth\" authentication mode sent the full browser cookie jar of the requesting user to its destination, including Open WebUI's own session cookie. The mode is documented to the administrator as forwarding only the user's OAuth access token. Every user whose request reached such a connection disclosed a live session credential to the destination, whether or not they were the administrator who configured it and whether or not an OAuth token was present.\r\n\r\n## Preconditions\r\nAn administrator has configured at least one OpenAI-compatible connection, OpenAPI tool server or terminal server with the \"OAuth\" authentication mode. Connections default to bearer authentication, so this mode is never active out of the box. No OAuth provider needs to be configured or return a token; the cookies were sent regardless. The destination only needs to observe the incoming Cookie header, which ordinary request logging does. Not affected: connections using the \"Session\" authentication mode, whose forwarding of session credentials is documented, and MCP tool servers, which never received cookies.\r\n\r\n## Impact\r\nThe operator of the destination receives the Open WebUI session cookie of every verified user whose request reaches it, including through routine calls such as the model list fetched on page load, with no action from the user beyond ordinary use. Replaying that cookie against the instance authenticates as that user for the lifetime of the token, which gives the destination full access to the account and administrative access where the user is an administrator. The destination is a server an administrator registered for OAuth authentication, a configuration that implied sending it only the OAuth access token.\r\n\r\n## Fix\r\nFixed in 0.11.4 by https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79 (OpenAI-compatible connections), https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23 (terminal servers) and https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807 (tool servers and terminal tools). Forwarding the cookie jar is now a separate per-connection setting that is off by default, so the OAuth mode sends only the OAuth access token in the Authorization header. Upgrading resolves the issue with no configuration change.\r\n\r\n## Root cause\r\nAffected component: the outbound header and cookie builder for OpenAI-compatible connections, the builder for OpenAPI tool servers and terminal tools, and the terminal server proxy.\r\nAffected setup: any deployment with a connection, tool server or terminal server set to the \"OAuth\" authentication mode.\r\n\r\nWhen the OAuth mode was added, its branch copied the cookie line from the neighbouring \"Session\" branch unchanged, so the whole inbound cookie jar was attached to the outbound request before, and independently of, the OAuth token lookup. The forwarded cookies were never narrowed to what the mode is documented to send. Because each outbound call carries the requesting user's own cookies, the disclosed session belongs to whichever user triggered the call.\r\n\r\n## Proof of concept\r\nReproduced by the reporter against a running 0.11.2 instance. An OpenAI-compatible connection was registered with a request-capturing destination and the \"OAuth\" authentication mode. A model list request authenticated only by the session cookie triggered the outbound call. The destination received the full cookie jar, including the session cookie, and no OAuth token. Replaying the captured cookie against the instance returned an authenticated response as the affected account.\r\n\r\nConfirmed during triage by running the connection header builder from 0.11.3 and 0.11.4 with the same session cookies and no OAuth token: 0.11.3 attaches the session cookie to the outbound request, and 0.11.4 attaches no cookies.\r\n\r\n## Credits\r\n@gigioneggiando\r\n@brodmart","summary":"Open WebUI sent the full browser cookie jar, including its own session cookie, to OpenAI-compatible connections, OpenAPI tool servers and terminal servers set to the OAuth authentication mode. The receiving server can replay that cookie to log in as the user, with admin access if the user is an administrator.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"open-webui","fixed":["0.11.4"],"affected":">= 0.6.27, < 0.11.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-200","open-webui","openai-compatible","self-hosted","terminal-server","tool-servers"],"not_affected_if":["default-config","mcp-only","no-oauth-mode-connections","session-auth-mode"],"how_to_check":"- Open Admin Settings and review each OpenAI-compatible connection, tool server and terminal server for one set to the \"OAuth\" authentication mode.\n- Check the running Open WebUI version, for example with `pip show open-webui`; versions from `0.6.27` up to but not including `0.11.4` are affected.","fix":"- `open-webui` `0.11.4` (fixed version; the advisory says upgrading needs no configuration change).","status":"open","published_at":"2026-09-27T19:55:15+00:00","first_seen_at":"2026-11-09T22:53:28+00:00","triaged_at":"2026-11-09T23:00:42+00:00","updated_at":"2026-11-09T23:10:12+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T23:00:42Z","model":"claude-haiku-5-5","output":{"fix":"- `open-webui` `0.11.4` (fixed version; the advisory says upgrading needs no configuration change).","reach":"network","title":"Open WebUI: OAuth-mode connections leak users' session cookies to destination servers","impact":"high","summary":"Open WebUI sent the full browser cookie jar, including its own session cookie, to OpenAI-compatible connections, OpenAPI tool servers and terminal servers set to the OAuth authentication mode. The receiving server can replay that cookie to log in as the user, with admin access if the user is an administrator.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["open-webui","self-hosted","openai-compatible","tool-servers","terminal-server"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"destination server gets session cookies and takes over user accounts","analyst_note":"","how_to_check":"- Open Admin Settings and review each OpenAI-compatible connection, tool server and terminal server for one set to the \"OAuth\" authentication mode.\n- Check the running Open WebUI version, for example with `pip show open-webui`; versions from `0.6.27` up to but not including `0.11.4` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-oauth-mode-connections","mcp-only","session-auth-mode"],"who_is_affected":"Only deployments that have at least one OpenAI-compatible connection, OpenAPI tool server or terminal server configured with the \"OAuth\" authentication mode are exposed. Every user whose requests reach such a connection leaks a live session cookie to that destination, whether or not they configured it. Connections default to bearer authentication, and MCP tool servers and \"Session\" mode connections are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000925,"input_tokens":5858,"output_tokens":678,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109292':17A,25A '-200':33B '-2026':16A,24A '/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807':414C '/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23':408C '/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79':401C '0.11.2':589C '0.11.3':663C,675C '0.11.4':397C,665C '74rp':22A 'access':94B,167C,359C,365C,392C,445C 'account':362C,652C 'action':331C 'activ':237C 'add':511C 'admin':93B 'administr':100B,159C,191C,206C,364C,371C,378C 'affect':274C,461C,488C,651C 'ai':30B 'ai-tool':29B 'attach':531C,676C 'authent':77B,131C,225C,231C,279C,344C,382C,504C,607C,613C,647C 'author':449C 'bearer':230C 'belong':572C 'beyond':335C 'box':241C 'branch':513C,522C 'browser':54B,136C 'builder':468C,475C,661C 'c':679C 'call':319C,561C,578C,622C 'captur':602C,640C 'carri':562C 'caus':460C 'chang':458C 'compat':39B,65B,119C,214C,404C,472C,594C 'compon':462C 'concept':581C 'configur':127C,193C,208C,248C,384C,457C 'confirm':653C 'connect':10A,66B,110C,120C,176C,215C,227C,275C,405C,430C,473C,494C,595C,659C 'cooki':55B,61B,85B,137C,152C,254C,266C,295C,307C,340C,422C,467C,516C,528C,546C,568C,618C,628C,633C,641C,670C 'copi':514C 'credenti':181C,285C 'cve':15A,23A 'cwe':32B 'default':228C,436C 'deploy':491C 'destin':145C,184C,259C,301C,357C,373C,603C,624C 'disclos':5A,105C,177C,570C 'document':156C,287C,555C 'everi':169C,309C 'fetch':325C 'fix':394C,395C 'forward':161C,282C,420C,545C 'full':53B,135C,358C,627C 'ghsa':19A 'ghsa-gqfh-jxvw-74rp':18A 'github.com':400C,407C,413C 'github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807':412C 'github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23':406C 'github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79':399C 'give':355C 'gqfh':20A 'header':267C,450C,465C,660C 'host':42B 'impact':296C 'impli':386C 'inbound':527C 'includ':57B,146C,316C,630C 'incom':265C 'independ':538C 'instanc':343C,590C,644C 'issu':454C 'jar':56B,138C,423C,529C,629C 'jxvw':21A 'least':210C 'lifetim':350C 'line':517C 'list':324C,611C 'live':179C 'load':328C 'log':87B,271C 'lookup':543C 'mcp':289C 'mode':9A,78B,109C,132C,154C,226C,234C,280C,440C,505C,509C,553C,608C 'model':323C,610C 'narrow':549C 'need':245C,261C 'neighbour':520C 'never':236C,293C,548C 'oauth':8A,76B,108C,130C,166C,200C,224C,243C,381C,391C,439C,444C,503C,508C,541C,606C,636C,673C 'oauth-mod':7A,107C 'observ':263C 'one':211C 'open':27A,35B,49B,147C,304C 'open-webui':26A,34B 'openai':38B,64B,118C,213C,403C,471C,593C 'openai-compat':37B,63B,117C,212C,402C,470C,592C 'openapi':67B,121C,216C,477C 'oper':298C 'ordinari':269C,336C 'outbound':464C,534C,560C,621C 'page':327C 'per':429C 'per-connect':428C 'precondit':204C 'present':203C 'proof':579C 'provid':244C 'proxi':487C 'reach':173C,314C 'receiv':80B,294C,302C,625C 'regardless':257C 'regist':379C,597C 'replay':83B,338C,638C 'report':585C 'reproduc':582C 'request':141C,172C,270C,313C,535C,564C,601C,612C 'request-captur':600C 'resolv':452C 'respons':648C 'return':250C,645C 'root':459C 'routin':318C 'run':588C,657C 'self':41B 'self-host':40B 'send':387C,441C,557C 'sent':51B,133C,256C 'separ':427C 'server':12A,45B,48B,69B,72B,81B,112C,123C,126C,218C,221C,291C,376C,410C,416C,479C,486C,496C,499C 'session':3A,60B,103C,151C,180C,278C,284C,306C,521C,571C,617C,632C,669C,678C 'set':73B,431C,500C 'setup':489C 'summari':115C 'termin':14A,44B,71B,114C,125C,220C,409C,418C,481C,485C,498C 'terminal-serv':43B 'token':4A,104C,168C,201C,252C,353C,393C,446C,542C,637C,674C 'tool':11A,31B,47B,68B,111C,122C,217C,290C,415C,419C,478C,482C,495C 'tool-serv':46B 'triag':655C 'trigger':576C,619C 'unchang':523C 'upgrad':451C 'use':276C,337C 'user':2A,91B,97B,102C,142C,164C,170C,311C,334C,347C,368C,565C,575C 'verifi':310C 'via':6A,106C 'webui':28A,36B,50B,148C,305C 'whether':185C,196C 'whichev':574C 'whole':526C 'whose':171C,281C,312C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that have at least one OpenAI-compatible connection, OpenAPI tool server or terminal server configured with the \"OAuth\" authentication mode are exposed. Every user whose requests reach such a connection leaks a live session cookie to that destination, whether or not they configured it. Connections default to bearer authentication, and MCP tool servers and \"Session\" mode connections are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openwebui"],"ptokens":["open","webui"],"labels":["aitooling","cwe200","high","openaicompatible","openwebui","pypi","selfhosted","terminalserver","toolservers"],"campaign_type":null,"search_a":"'-109292':17A,25A '-2026':16A,24A '74rp':22A 'connect':10A 'cve':15A,23A 'disclos':5A 'ghsa':19A 'ghsa-gqfh-jxvw-74rp':18A 'gqfh':20A 'jxvw':21A 'mode':9A 'oauth':8A 'oauth-mod':7A 'open':27A 'open-webui':26A 'server':12A 'session':3A 'termin':14A 'token':4A 'tool':11A 'user':2A 'via':6A 'webui':28A","search_b":"'-200':33B 'access':94B 'admin':93B 'administr':100B 'ai':30B 'ai-tool':29B 'authent':77B 'browser':54B 'compat':39B,65B 'connect':66B 'cooki':55B,61B,85B 'cwe':32B 'full':53B 'host':42B 'includ':57B 'jar':56B 'log':87B 'mode':78B 'oauth':76B 'open':35B,49B 'open-webui':34B 'openai':38B,64B 'openai-compat':37B,63B 'openapi':67B 'receiv':80B 'replay':83B 'self':41B 'self-host':40B 'sent':51B 'server':45B,48B,69B,72B,81B 'session':60B 'set':73B 'termin':44B,71B 'terminal-serv':43B 'tool':31B,47B,68B 'tool-serv':46B 'user':91B,97B 'webui':36B,50B","search_c":"'/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807':414C '/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23':408C '/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79':401C '0.11.2':589C '0.11.3':663C,675C '0.11.4':397C,665C 'access':167C,359C,365C,392C,445C 'account':362C,652C 'action':331C 'activ':237C 'add':511C 'administr':159C,191C,206C,364C,371C,378C 'affect':274C,461C,488C,651C 'attach':531C,676C 'authent':131C,225C,231C,279C,344C,382C,504C,607C,613C,647C 'author':449C 'bearer':230C 'belong':572C 'beyond':335C 'box':241C 'branch':513C,522C 'browser':136C 'builder':468C,475C,661C 'c':679C 'call':319C,561C,578C,622C 'captur':602C,640C 'carri':562C 'caus':460C 'chang':458C 'compat':119C,214C,404C,472C,594C 'compon':462C 'concept':581C 'configur':127C,193C,208C,248C,384C,457C 'confirm':653C 'connect':110C,120C,176C,215C,227C,275C,405C,430C,473C,494C,595C,659C 'cooki':137C,152C,254C,266C,295C,307C,340C,422C,467C,516C,528C,546C,568C,618C,628C,633C,641C,670C 'copi':514C 'credenti':181C,285C 'default':228C,436C 'deploy':491C 'destin':145C,184C,259C,301C,357C,373C,603C,624C 'disclos':105C,177C,570C 'document':156C,287C,555C 'everi':169C,309C 'fetch':325C 'fix':394C,395C 'forward':161C,282C,420C,545C 'full':135C,358C,627C 'github.com':400C,407C,413C 'github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807':412C 'github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23':406C 'github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79':399C 'give':355C 'header':267C,450C,465C,660C 'impact':296C 'impli':386C 'inbound':527C 'includ':146C,316C,630C 'incom':265C 'independ':538C 'instanc':343C,590C,644C 'issu':454C 'jar':138C,423C,529C,629C 'least':210C 'lifetim':350C 'line':517C 'list':324C,611C 'live':179C 'load':328C 'log':271C 'lookup':543C 'mcp':289C 'mode':109C,132C,154C,226C,234C,280C,440C,505C,509C,553C,608C 'model':323C,610C 'narrow':549C 'need':245C,261C 'neighbour':520C 'never':236C,293C,548C 'oauth':108C,130C,166C,200C,224C,243C,381C,391C,439C,444C,503C,508C,541C,606C,636C,673C 'oauth-mod':107C 'observ':263C 'one':211C 'open':147C,304C 'openai':118C,213C,403C,471C,593C 'openai-compat':117C,212C,402C,470C,592C 'openapi':121C,216C,477C 'oper':298C 'ordinari':269C,336C 'outbound':464C,534C,560C,621C 'page':327C 'per':429C 'per-connect':428C 'precondit':204C 'present':203C 'proof':579C 'provid':244C 'proxi':487C 'reach':173C,314C 'receiv':294C,302C,625C 'regardless':257C 'regist':379C,597C 'replay':338C,638C 'report':585C 'reproduc':582C 'request':141C,172C,270C,313C,535C,564C,601C,612C 'request-captur':600C 'resolv':452C 'respons':648C 'return':250C,645C 'root':459C 'routin':318C 'run':588C,657C 'send':387C,441C,557C 'sent':133C,256C 'separ':427C 'server':112C,123C,126C,218C,221C,291C,376C,410C,416C,479C,486C,496C,499C 'session':103C,151C,180C,278C,284C,306C,521C,571C,617C,632C,669C,678C 'set':431C,500C 'setup':489C 'summari':115C 'termin':114C,125C,220C,409C,418C,481C,485C,498C 'token':104C,168C,201C,252C,353C,393C,446C,542C,637C,674C 'tool':111C,122C,217C,290C,415C,419C,478C,482C,495C 'triag':655C 'trigger':576C,619C 'unchang':523C 'upgrad':451C 'use':276C,337C 'user':102C,142C,164C,170C,311C,334C,347C,368C,565C,575C 'verifi':310C 'via':106C 'webui':148C,305C 'whether':185C,196C 'whichev':574C 'whole':526C 'whose':171C,281C,312C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-27T19:55:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-gqfh-jxvw-74rp","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp","severity":"medium","published_at":"2026-09-27T19:55:15+00:00","modified_at":"2026-10-28T20:43:55+00:00","first_seen_at":"2026-11-09T22:53:28+00:00","fetched_at":"2026-11-09T22:53:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-109292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109292","severity":null,"published_at":"2026-10-12T17:17:22+00:00","modified_at":"2026-10-15T15:55:45+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110660,"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-27T19:55:15+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":111008,"url":"https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111009,"url":"https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111010,"url":"https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111012,"url":"https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}