CVE-2026-56398: open-webui Improper Input Validation

Vulnerability summary

CVE-2026-56398 is a critical (CVSS 9.0) Improper Input Validation vulnerability in open-webui. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-07-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.