Open WebUI’s terminal proxy allows a malicious user to craft a query string that injects an unencoded session_id and supplies a user_id, causing the backend to resolve a different user identity. Additionally, the proxy forwards the X‑User‑Id header without validation, making the identity claim integrity‑unbound. These weaknesses allow an attacker to impersonate another user and obtain terminal access to that user’s environment.

Open WebUI installations using any legacy version before 0.10.0 are affected. The flaw is located in the backend/open_webui/routers/terminals.py component that constructs ws_terminal upstream URLs, impacting all instances that rely on the terminal proxy functionality.

The CVSS score of 8 indicates a high severity. The EPSS score of <1% indicates a low likelihood of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. An attacker can achieve unauthorized terminal access by sending crafted requests to the proxy to impersonate another user, potentially gaining control over the target user's session.