EUVD-2026-97594

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal...

CVE-2026-109292

The Open WebUI software (versions 0.6.27 before 0.11.4 ) is vulnerable to an information disclosure flaw. During OAuth-mode connections , the application may send the full browser cookie jar to destination servers. This allows operators of OpenAI-compatible connections , OpenAPI tool servers , or...