CVE-2026-87015: Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments are exposed to session takeover?
Open WebUI versions from 0.6.27 through 0.11.0 are affected when multiple external tool servers are attached and requests can reach a different tool server configured for bearer authentication after a session or system OAuth connection is processed.
What does an attacker need to exploit this issue?
The operator of an affected bearer-authenticated tool server could receive a calling user's Open WebUI session cookies. They could then reuse those cookies to take over that user's account; exploitation requires user interaction according to the supplied vector.
Are deployments on the fixed release affected?
No. The issue is fixed in Open WebUI version 0.11.1.