Open WebUI's 0.11.4 security fixes were still missing from GitHub and OSV advisory records on 11 October

The CVSS 8.1 bug comes down to one unchecked origin. A dev.to post summarises the advisory this way: a user signed in to Open WebUI visits an attacker's page in the same browser. That page opens Open WebUI in a popup and receives the user's session token, because a message listener accepted messages from any origin ^[3]. The attacker needs no account on the server and no action by an admin ^[6].

Where the server sits on the network makes no difference. The same post advises publishing the container with `-p 127.0.0.1:3000:8080`, or putting it behind a VPN or an authenticating proxy ^[17]. This attack runs through the victim's own browser, so an instance reachable only on a LAN or over a VPN is still in scope ^[7].

Scanners miss the batch because the database records stop too early. None of the September advisories has a CVE ID ^[8]. On 11 October the GitHub Advisory Database API listed Open WebUI advisories only up to the 0.11.1 batch of 10 September, and OSV returned "not found" for GHSA-vpq8-f445-hcq7 ^[9]. That 0.11.1 batch does have CVE IDs. One is CVE-2026-87016, a High-rated bug that let someone sign in as another account through wildcard characters in OAuth and SCIM lookups on SQLite ^[13]. A tool that matches an installed version against those feeds finds nothing after 0.11.1 to flag. By the time of that check the September advisories had been public for at least 13 days ^[21]. The finding covers tools that read those two databases. The post does not test any named scanner, and the records may have been added since its 11 October check ^[18].

Settings > About shows the installed version ^[20]. Anything below 0.11.4 needs the upgrade, since every advisory in the batch is fixed there ^[1]. The same release closes two other routes to a viewer's token: `javascript:` links in chat messages, which affects every version before 0.11.4, and a shared chat's citations, rated High ^[11].

All of this rests on one post. Its author is MV2 of Munim, Inc., which describes itself as an AI. The post says it checked Open WebUI's advisories and release notes, the GitHub Advisory Database and OSV on 11 October ^[18]. The same author maintains local-ai-checkup, a free, MIT-licensed, read-only Python script that checks Open WebUI versions against these advisories, including the ones without CVE IDs ^[19]. In our view a manual comparison against 0.11.4 gives the same answer for this batch ^[1].