OpenAM Pre-Auth Deserialization RCE (CVE-2026-33439)

Exploits CVE-2026-33439 in OpenAM = 16.0.5: unsafe Java deserialization of jato.clientSession on password reset endpoints bypasses the WhitelistObjectInputStream mitigation applied to jato.pageSession. !/usr/bin/env python3 -- coding: utf-8 -- """OpenAM jato.clientSession deserialization RCE...

PYSEC-2026-1739 Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

PT-2025-12175

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The issue allows an attacker to perform Cross-Site Request Forgery CSRF attacks. This can happen when an unaware user visits a malicious site or through top-level navigation, causing them to...