CVEFinder.io

CVE-2026-56398

⚠ī¸ high
🔍 Scan for this CVE
Summary

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to

Description

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

CVSS Score
7.3
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-15
First Seen: 2026-07-16
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.3% of all 338,292 vulnerabilities in our database.

#151,238
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 15, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
matte1782 (reporter)
SSVC data provided by CISA
Last Modified 2026-07-16
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-20

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
openwebui open_webui Affected
< 0.9.5

🔗 References 2

https://github.com/open-webui/open-webui/security/ad...
Exploit Vendor Advisory
https://www.vulncheck.com/advisories/open-webui-stor...
Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-56400 ⚠ī¸ high 8.3 0.3 open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow... 2026-07-15
CVE-2026-59212 đŸ”ļ medium 5.4 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_... 2026-07-09
CVE-2026-59213 ℹī¸ low 3.5 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all... 2026-07-09
CVE-2026-59214 ⚠ī¸ high 7.3 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c... 2026-07-09
CVE-2026-59215 ℹī¸ low 3.1 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa... 2026-07-09
CVE-2026-59216 ⚠ī¸ high 7.7 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de... 2026-07-09
These CVEs affect the same products