Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015

Open WebUI versions 0.6.27 through 0.11.1 are affected by a session cookie leakage flaw in backend/open_webui/utils/tools.py . The cookie jar from the enclosing connection loop was not bound to each external tool callable, so when multiple tool servers were attached and a session or system OAuth ...

EUVD-2026-51613

Contao crawler leaks auth credentials to external hosts...

CVE-2026-55824 Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

CVE-2026-55824 Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

CVE-2026-55824 Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

hono: Hono - Timing Attack in basicAuth and bearerAuth Middleware

A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...

hono: Hono - Timing Attack in basicAuth and bearerAuth Middleware

A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...

CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

CVE-2026-47726

CVE-2026-47726 (nebula-mesh) affects nebula-mesh prior to v0.3.2. The handleGetAuditLog endpoint in internal/api/audit.go does not enforce an admin check, allowing any operator API key with bearer authentication to retrieve the full audit log via store.ListAuditEntries (limit 1000). Exposed data ...

CVE-2026-56764

A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...

CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...

CVE-2026-46555 WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration

WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...

CVE-2026-46555

The CVE applies to WhatsApp MCP Server, where the whatsapp-bridge HTTP API on 127.0.0.1:8080 is unauthenticated and lacks Host header validation. The /api/send endpoint accepts an absolute media_path, enabling a local caller (including sibling MCP servers, IDE extensions, or other processes in th...

CVE-2026-56764

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing...

CVE-2026-56764

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing...

CVE-2026-56764 Hono - Timing Attack in basicAuth and bearerAuth Middleware

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing...