10137 matches found
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...
GHSA-5GPJ-VJ23-VHHV Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...
CVE-2026-70490
Open WebUI (self-hosted AI platform) versions 0.8.8–0.11.0 contain a flaw where the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticates its own first-message JWT and omits the verified-user role gate enforced on HTTP terminal routes. As a result, accounts with pendin...
CVE-2026-70490
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
EUVD-2026-52918
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
resterm v0.51.1
Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...
Exploit for CVE-2026-69243
CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request...
daphne: daphne: Denial of Service via excessive WebSocket message size
A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service DoS for the affected system...
daphne: daphne: Denial of Service via excessive WebSocket message size
A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service DoS for the affected system...
CLSA-2026-1785117461 TuxCare security update for ws (1 CVE)
TuxCare rebuilt ws to address 1 CVE. Fixed in 1.1.1-tuxcare.2...
CLSA-2026-1784769533 TuxCare security update for ws (1 CVE)
TuxCare rebuilt ws to address 1 CVE. Fixed in 8.18.0-tuxcare.2...
CLSA-2026-1773188138 TuxCare security update for websocket-extensions (1 CVE)
TuxCare rebuilt websocket-extensions to address 1 CVE. Fixed in 0.1.1-tuxcare.3...
AIOHTTP: HTTP request smuggling via WebSocket upgrade
SummaryThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ImpactIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware ...
PYSEC-2026-3546 AIOHTTP: HTTP request smuggling via WebSocket upgrade
Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...
PYSEC-2026-3547 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Summary The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated. Impact A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to ...
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
SummaryThe client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated. ImpactA client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be...
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
SummaryThe terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...