Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 09:15:51 +0000 CVE-2026-109286 — Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal https://db.gcve.eu/vuln/cve-2026-109286 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user&#39;s session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim&#39;s JWT for full API access.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user&#39;s session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim&#39;s JWT for full API access.</p> https://db.gcve.eu/vuln/cve-2026-109286