ZDI-CAN-28259: ZDI-26-033: (0Day) Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise.
Other sources
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-0767.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28259?
ZDI-CAN-28259 is classified as a critical vulnerability due to the potential for sensitive information disclosure without authentication.
How do I fix ZDI-CAN-28259?
To mitigate ZDI-CAN-28259, implement secure transmission protocols, such as HTTPS, to encrypt credentials during transmission.
Can ZDI-CAN-28259 be exploited remotely?
Yes, ZDI-CAN-28259 can be exploited by network-adjacent attackers, meaning they do not require direct access to the affected system.
Which software is affected by ZDI-CAN-28259?
The vulnerability affects installations of Open WebUI across all versions.
What type of information can be disclosed via ZDI-CAN-28259?
ZDI-CAN-28259 can lead to the disclosure of sensitive credentials transmitted in cleartext.