Same-origin XSS in Open WebUI terminal port previews enables account takeover

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1.

• Open WebUI open-webui is affected in >= 0.8.11, < 0.11.1, which the vendor advisory also expresses as >= 0.8.11, <= 0.11.0.
• The confirmed patched release is 0.11.1. The evidence does not establish the status of other parallel or later release branches.
• Deployments with no terminal server configured are identified by the advisory as not affected.
• Personal terminals that point to an external URL are not affected because the previewed document is outside the application's origin.
• A deployment that already applies a restrictive Content-Security-Policy to proxied responses through TERMINAL_PROXY_HEADERS or CONTENT_SECURITY_POLICY is identified by the advisory as not exposed.

The flaw is in src/lib/components/chat/FileNav/PortPreview.svelte, where terminal port content is rendered in an iframe sandbox containing both allow-scripts and allow-same-origin. The terminal proxy serves that content from the Open WebUI origin, so those sandbox permissions remove the isolation boundary between the previewed page and the application. An authenticated user needs access to a shared terminal server and the ability to run a process listening on a port that can serve attacker-controlled script content. When a victim opens the port list and selects that port, the previewed script can execute in the application origin and read the victim's session token from browser local storage. The relevant reachability conditions include a shared terminal server accessible to both attacker and victim; personal terminals that point to an external URL are not affected. The public record does not describe additional token-handling or authentication limitations beyond these conditions.

The vulnerability is reachable over the network through Open WebUI. The attacker needs a normal authenticated account, access to a shared terminal connection and the ability to serve content from a previewed port; administrator privileges are not required. The victim must interact by opening the port list and selecting the attacker's port. Exploitation complexity is low, but user interaction is required. The supplied record and the vendor advisory do not establish in-the-wild exploitation or a public exploit.

The previewed page can execute in the Open WebUI origin instead of an isolated opaque origin. According to the advisory, the page can read the victim's session token, resulting in full account takeover. The impact crosses from the preview component into the victim's account and the privileges held by that account; administrator accounts or accounts with workspace.functions may face more severe consequences, including server-side code execution through Functions. Exploitation remains constrained by the need for an authenticated attacker, access to a shared terminal and victim interaction with the correct port preview. Deployments without a configured terminal server and personal terminals using external URLs are outside the documented affected conditions.

Successful exploitation can expose a session token and allow takeover of the victim's Open WebUI account. The attacker can then act with the privileges of the compromised account, creating confidentiality and integrity loss within that account's scope. If the victim is an administrator or holds workspace.functions, the advisory states that the takeover may extend to server-side code execution through Functions. The documented impact concerns account and data access rather than service availability.

1. Upgrade Open WebUI to 0.11.1, the release confirmed by the advisory as fixing the issue. The advisory states that upgrading is sufficient and does not require a configuration change.
2. If an upgrade cannot be completed immediately, prioritize restricting or temporarily disabling shared terminal servers that are reachable by both untrusted authenticated users and potential victims. This reduces the documented exposure condition but is not a vendor-confirmed patch.
3. Consider applying a restrictive Content-Security-Policy to terminal proxy responses through the available deployment configuration, including TERMINAL_PROXY_HEADERS or CONTENT_SECURITY_POLICY. The advisory identifies an effective CSP as a condition that prevents exposure, but it does not provide a complete mitigation configuration, so this should not replace upgrading.
4. After upgrading, verify the running version, shared terminal configuration and port preview behavior in a test environment before restoring broad user access.

1. Inventory Open WebUI deployments and identify instances within the affected branch listed in affected_summary.
2. Determine whether each deployment has shared terminal servers configured, especially terminal connections accessible by multiple users.
3. Check whether the terminal proxy serves content under the Open WebUI origin and whether TERMINAL_PROXY_HEADERS or CONTENT_SECURITY_POLICY applies a restrictive Content-Security-Policy to proxied responses.
4. Review user permissions for shared terminal connections and whether untrusted users can start processes listening on ports exposed through the port preview.
5. Review sign-in activity, account changes and administrative actions after users opened terminal port previews. This is precautionary monitoring, not a known IOC; the advisory does not provide a dedicated log signature or IOC, and the absence of related logs does not prove that a deployment is safe.