Open WebUI from version 0.6.27 up to just before 0.11.4 contains a flaw that allows anyone connected to an OAuth‑mode session to leak the full browser cookie jar. The vulnerability can lead to exposure of user session cookies, which can be reused to hijack accounts, including administrators, and gain unauthorized access to the system. The weakness is a classic information disclosure flaw (CWE‑200).

Vendors: Open WebUI. Affected product: Open WebUI web application. Vulnerable releases include all versions from 0.6.27 up to, but not including, 0.11.4. No specific patch level is mentioned beyond the upgrade path to 0.11.4 or newer.

The CVSS score of 7.6 indicates a high severity vulnerability., implying no current data on exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is through OAuth‑mode connections: an attacker who can initiate or observe such a connection can capture forwarded session cookies and replay them, resulting in account hijack. No additional prerequisites are cited, but the exploit relies on the victim's browser sending cookies to the server during the connection. Given the high impact of session hijack, rapid remediation is advised.