CVE-2026-45665

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitization order (specifically, DOMPurify is executed before the marked library). This vulnerability allows a compromised or malicious administrator to plant a malicious payload in the global banner. Crucially, this vector enables Privilege Escalation, as the malicious banner is rendered for all users, including the Super Admin (Primary Admin). Consequently, the payload successfully bypasses the existing security mechanism. An attacker can leverage this to steal the Super Admin's session token This vulnerability is fixed in 0.8.0.

• CWE-79

• https://github.com/open-webui/open-webui/security/advisories/GHSA-cqp4-qqvg-3787Exploit, Mitigation, Vendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-cqp4-qqvg-3787Exploit, Mitigation, Vendor Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4566A flaw has been found in Belkin F9K1122 1.00.33. The affecte…8.8
• CVE-2026-45660Statamic is a Laravel and Git powered content management sys…5.4
• CVE-2026-45661Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-45662Dokploy is a free, self-hostable Platform as a Service (PaaS…8.8
• CVE-2026-45663Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-45664ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-45666Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-45667Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-45668Trilium Notes is a cross-platform, hierarchical note taking …9.3
• CVE-2026-45669Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-4567A vulnerability has been found in Tenda A15 15.13.07.13. The…9.8
• CVE-2026-45670Nuxt is an open-source web development framework for Vue.js.…5.4