CVE-2026-56398

Katalog CVE

CVSS 9.0 · Critical EPSS 0,64%

Kerentanan Improper Input Validation pada openwebui open webui. Skor CVSS 3.1 9.0 (Critical) menurut NVD.

Deskripsi (NVD)

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-3wgj-c2hg-vm6q exploit · advisory vendor
• https://www.vulncheck.com/advisories/open-webui-stored-cross-site-scripting-via-oauth-picture-claim-svg-data-u... advisory pihak ketiga