Open WebUI Terminal Proxy Identity Forging and SSRF via Unvalidated Session ID

Vulnerability Overview This vulnerability involves the terminal proxy forwarding a spoofable, integrity-unbound user identity to the upstream server. Specifically, in , the terminal proxy forwards the Open WebUI user's identity as an authorization claim to the upstream terminal server/backend coordinator without binding it to the session via encryption. This forwarded identity is attacker-influenced on both proxy paths: 1. HTTP Path ( ): Sets the header to . The upstream trust as identity receives unsigned data; therefore, attackers can forge through other means (e.g., Man-in-the-Middle attacks, SSRF). 2. WebSocket Path ( ): Exploited via Open WebUI itself, requiring no other "means". It directly concatenates the path parameter into the upstream URL and appends afterward. Impact Scope Affected Versions: Fixed Versions: Remediation 1. Validate and URL-encode : Before constructing the upstream URL, validate and URL-encode (using ) and reject special characters (e.g., , , , , backslashes, control characters). When constructing query strings, ensure the upstream does not interpret attacker-controlled path content as a prefix. 2. Bind Forwarded Identity: Instead of passing the raw , use a short-lifecycle signed claim (e.g., HS256 over , , ) to bind the forwarded identity. Share the key only with specific upstreams for verification. POC Code Technical Details Forwarded Identity: The forwarded identity is an integrity-unbound bearer-type authorization claim. In the WebSocket path, is concatenated into the upstream URL without encoding or delimiter validation. Impact: Authenticated normal users can forge the terminal proxy to present another user's identity to the upstream backend coordinator. On the backend coordinator-hacker ( ) server, they can attach to the user's real-time PTY. The HTTP path variant also allows forging identity at the proxy layer for any upstream deployment trusting . Appendix: Affected Code Appendix: Merge In accordance with the triage policy, independent reports sharing the same root cause (spoofable/integrity-unbound forwarding of terminal identity) have been merged into the earliest submission: @smoke-wolf (earliest submission) — Lack of integrity binding and spoofability in HTTP path identity forwarding; upstream trusts the header. @repository — session ID query injection vector, proving that forwarding can be forged via Open WebUI itself without requiring other "means" as preconditions. Appendix: Recommended Fixes Validate and URL-encode before constructing the upstream URL ( ) and reject special characters (e.g., , , , , backslashes, control characters). When constructing query strings, ensure the upstream does not interpret attacker-controlled path content as a prefix. Bind the forwarded identity. Instead of passing the raw , use a short-lifecycle signed claim (e.g., HS256 over , , ) to bind the forwarded identity. Share the key only with specific upstreams for verification. Severity CVSS v3 Base Metrics - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Low - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVE ID CVE-2026-59224 Weaknesses CWE-287 CWE-290 Contributors @smoke-wolf smoke-wolf Reporter @repository repository reporter @Classic298 Classic298 Remediation developer

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI Terminal Proxy Identity Forging and SSRF via Unvalidated Session ID

More from this source