Vulnerability Description
Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openwebui | Open Webui | < 0.9.5 |
Related Weaknesses (CWE)
References
- https://github.com/open-webui/open-webui/security/advisories/GHSA-3wgj-c2hg-vm6qExploitVendor Advisory
- https://www.vulncheck.com/advisories/open-webui-stored-cross-site-scripting-via-Third Party Advisory
FAQ
What is CVE-2026-56398?
CVE-2026-56398 is a vulnerability with a CVSS score of 7.3 (HIGH). Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-...
How severe is CVE-2026-56398?
CVE-2026-56398 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56398?
Check the references section above for vendor advisories and patch information. Affected products include: Openwebui Open Webui.