Insufficient Session Expiration in Open WebUI - #VU130182
Published: May 5, 2026
Vulnerability identifier: #VU130182
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient session expiration issue as the application fails to invalidate the session cookie after logout. A remote attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user.
Affected software
Open WebUI
Remediation
Install updates from vendor's website.
Open WebUI - update to 0.3.33