Open WebUI versions before 0.9.5 suffer from a stored cross‑site scripting flaw in the OAuth authentication flow. The application incorrectly infers the MIME type of the picture claim URL from the file extension instead of the Content‑Type header, which allows an attacker to upload an SVG file that bypasses image validation. The malicious SVG is stored as a data URI and served to authenticated users as their profile image. When the victim’s browser requests this image, the inline script inside the SVG executes in the same origin, granting the attacker the ability to read authentication tokens and take over the victim’s account.

All releases of open‑webui:open‑webui prior to 0.9.5 are affected. Users relying on those earlier versions should upgrade to 0.9.5 or later, which removes the insecure MIME‑type inference and properly validates image content.

The CVSS score of 8.5 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker injects a malicious OAuth picture claim containing an SVG file and lures a legitimate user to authenticate via that OAuth flow. After the SVG is stored, any subsequent visit to the profile image endpoint triggers client‑side script execution, enabling token theft or full account compromise. Because the payload is embedded as a data URI and requires no external resources, conventional mitigations such as CSP can partly reduce risk, but the definitive fix is to apply the vendor‑supplied patch.