{"metadata": {"vulnerability": "CVE-2026-109292", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109292", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:12:52.833Z", "date_only": false, "value": "2026-10-12T14:12:52.833Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109292", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:04:52.925Z", "date_only": false, "value": "2026-10-12T16:04:52.925Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109292", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:04:52.925Z", "date_only": false, "value": "2026-10-12T16:04:52.925Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109292", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:03:48.287Z", "date_only": false, "value": "2026-10-12T17:03:48.287960Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429018801931211", "record": "CVE-2026-109292", "field": "creation_timestamp", "uuid": "b94566a3-8961-40f9-b08d-a60677d68bba", "content": "CVE-2026-109292 Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109292https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rphttps://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections#open-webui#CVE_2026_109292#bot", "url": "https://infosec.exchange/users/cve/statuses/117429018801931211"}, {"timestamp": "2026-10-12T17:17:22Z", "date_only": false, "value": "2026-10-12T17:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CRCQ-C44M-C92X", "record": "GHSA-CRCQ-C44M-C92X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:22.500Z", "date_only": false, "value": "2026-10-12T17:17:22.500", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109292", "record": "FKIE_CVE-2026-109292", "field": "published"}, {"timestamp": "2026-10-12T18:31:44Z", "date_only": false, "value": "2026-10-12T18:31:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CRCQ-C44M-C92X", "record": "GHSA-CRCQ-C44M-C92X", "field": "published"}, {"timestamp": "2026-10-12T18:31:44Z", "date_only": false, "value": "2026-10-12T18:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CRCQ-C44M-C92X", "record": "GHSA-CRCQ-C44M-C92X", "field": "modified"}, {"timestamp": "2026-10-13T04:30:05.720Z", "date_only": false, "value": "2026-10-13T04:30:05.720058Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq74gszcv2n", "record": "CVE-2026-109292", "field": "creation_timestamp", "uuid": "8c5c1ce8-73f2-42e9-a280-d4640b71c177", "content": "CVE-2026-109292\nVersions of Open WebUI from 0.6.27 up to 0.11.3 may send the full set of browser cookies to the server when using OAuth connections. This allows the server to capture those cookies and reuse them to take over\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq74gszcv2n"}, {"timestamp": "2026-10-15T02:39:28.813Z", "date_only": false, "value": "2026-10-15T02:39:28.813205Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109292", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T02:39:28.813Z", "date_only": false, "value": "2026-10-15T02:39:28.813205Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109292", "record": "FKIE_CVE-2026-109292", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T02:40:17.334Z", "date_only": false, "value": "2026-10-15T02:40:17.334Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109292", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T02:40:17.334Z", "date_only": false, "value": "2026-10-15T02:40:17.334Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109292", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T15:55:45.630Z", "date_only": false, "value": "2026-10-15T15:55:45.630", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109292", "record": "FKIE_CVE-2026-109292", "field": "lastModified"}]}