Open WebUI OAuth Profile Picture Stored XSS (CVE-2026-56398)

Technical Analysis

The vulnerability stems from improper content-type validation in Open WebUI's OAuth authentication flow, where the profile 'picture' claim URL is fetched and its MIME type inferred from the file extension rather than the actual Content-Type header returned by the server. This allows an attacker-controlled SVG file to bypass image validation and be stored as a data URI in the user's profile. Because the profile image endpoint serves this content with inline disposition and lacks default security headers (such as Content-Security-Policy or X-Content-Type-Options), the SVG's embedded JavaScript executes in the same origin as the application when viewed by other authenticated users, allowing theft of session/authentication tokens and full account takeover. Exploitation requires an attacker to control or manipulate an OAuth identity provider response (or intercept/spoof the picture claim) that is trusted by the Open WebUI instance. Since Open WebUI is widely deployed as a front-end and management interface for local and cloud LLM deployments, RAG pipelines, and agent orchestration tools, a compromised account or stolen session token could grant an attacker access to connected model backends, API keys, chat histories, and any agent tool-execution capabilities exposed through the UI, representing a direct risk to AI agent operational security.

Affected Systems

Open WebUI versions prior to 0.9.5, specifically deployments using OAuth authentication with externally-controlled or attacker-influenced 'picture' claim URLs

Indicators of Compromise

• No public IOCs available at this time; watch for anomalous SVG file uploads/data URIs in user profile fields, unexpected inline SVG content served from /profile/image or similar endpoints, and unusual OAuth picture claim URLs pointing to attacker-controlled domains

Remediation Steps

1. 1

   Upgrade Open WebUI

   Update to Open WebUI version 0.9.5 or later, which validates image MIME types using Content-Type headers rather than file extensions.

2. 2

   Enforce Content Security Policy

   Apply strict CSP headers (disallowing inline script execution) and X-Content-Type-Options: nosniff on all endpoints serving user-uploaded or OAuth-derived profile content.

3. 3

   Sanitize SVG content

   Strip or disallow SVG uploads/data URIs entirely for profile images, or sanitize SVG content server-side to remove embedded scripts and event handlers.

4. 4

   Serve images with safe disposition

   Serve profile images with Content-Disposition: attachment or from a separate, sandboxed origin/domain to prevent same-origin script execution.

5. 5

   Audit OAuth identity provider trust

   Restrict and validate which OAuth providers and claim sources are trusted, and monitor for anomalous picture claim URLs.

6. 6

   Rotate credentials post-incident

   If exploitation is suspected, rotate authentication tokens, API keys, and session secrets for affected Open WebUI instances and any connected model/agent backends.