Open WebUI is a self‑hosted artificial intelligence platform that operates entirely offline. Prior to version 0.9.6, the chat message listener accepted non‑same‑origin input:prompt and action:submit messages, allowing an external page to set prompt text and trigger submitPrompt() in an authenticated victim session. This flaw, classified as CWE‑346, lets a cross‑origin attacker automatically post these messages, causing the victim’s browser to send unauthorized POST /api/v1/chats/new and POST /api/chat/completions requests containing attacker‑controlled prompts, thereby executing model or tool actions under the victim’s privileges without consent. The vulnerability was fixed in version 0.9.6.

Open WebUI self‑hosted AI platform, any deployment running a version earlier than 0.9.6 is susceptible.

The CVSS score of 7.1 indicates a high severity, but there is no EPSS data and no KEV listing, so widespread exploitation evidence is lacking. Nevertheless, a malicious web page can exploit this flaw by posting an action:submit event to a victim’s open session, which will trigger the unwanted API calls without user interaction. Because no server‑side privilege escalation is required, the attacker can compromise confidentiality and integrity of the victim’s data and perform unauthorized model execution, posing a significant risk.