CVE-2026-109292 open-webui CVE debrief

Who should care

Defenders responsible for Open WebUI installations, particularly those using OAuth-mode connections, should assess their exposure and take immediate action to mitigate the risk of session cookie disclosure.

Why it matters

Defenders should care about CVE-2026-109292 because it allows attackers to obtain user session cookies via OAuth-mode connections in Open WebUI versions 0.6.27 before 0.11.4. This vulnerability can lead to account hijacking and potential elevation of privileges. Affected deployments should verify their exposure, assess the risk, and apply patches or mitigations as needed.

• Account hijacking through session cookie replay
• Potential elevation of privileges for attackers
• Increased risk for administrators and users of affected Open WebUI installations
• Need for verification of server configurations and patch application

Technical summary

The vulnerability in Open WebUI allows destination servers to obtain user session cookies via OAuth-mode connections. This issue affects versions 0.6.27 before 0.11.4 and enables operators of certain servers to capture and replay session cookies, potentially leading to account hijacking. The vulnerability can be mitigated by updating to version 0.11.4 or later and reviewing server configurations for potential vulnerabilities. Affected deployments should verify their exposure and assess the risk of session cookie disclosure.

Defensive priority

Defenders should prioritize verifying exposure of Open WebUI installations to OAuth-mode connections and assessing the risk of session cookie disclosure. Immediate actions include updating to version 0.11.4 or later and reviewing server configurations for potential vulnerabilities.

Recommended defensive actions

• Verify Open WebUI installations for exposure to OAuth-mode connections
• Update Open WebUI to version 0.11.4 or later
• Review server configurations for potential vulnerabilities
• Monitor for suspicious activity related to session cookie disclosure
• Implement compensating controls for exposed systems
• Conduct asset inventory to identify affected deployments
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and patch commits. However, there is limited information on exploitation or specific attack scenarios.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.