CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments and users are exposed?
Open WebUI versions from 0.8.11 through versions before 0.11.1 are affected. Exploitation requires users to have access to a shared terminal server and to open a terminal port preview controlled by another authenticated user.
What must an attacker do to exploit this issue?
The attacker must be authenticated and able to host script content on a port of a shared terminal server. They then need a victim to open the preview for that port, allowing the attacker-controlled content to execute from the Open WebUI origin and potentially take over the victim's account.
What is the remediation?
Upgrade Open WebUI to version 0.11.1, which fixes the issue. If upgrading cannot happen immediately, avoid opening terminal port previews for untrusted or other users' terminal content and restrict access to shared terminal servers.