{"metadata": {"vulnerability": "cve-2026-109286", "count": 12, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109286", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:12:03.637Z", "date_only": false, "value": "2026-10-12T14:12:03.637Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109286", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:04:48.429Z", "date_only": false, "value": "2026-10-12T16:04:48.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109286", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:04:48.429Z", "date_only": false, "value": "2026-10-12T16:04:48.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109286", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T16:04:48.429Z", "date_only": false, "value": "2026-10-12T16:04:48.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109286", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T16:59:46.272Z", "date_only": false, "value": "2026-10-12T16:59:46.272295Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429002942757350", "record": "CVE-2026-109286", "field": "creation_timestamp", "uuid": "d0918610-9804-45b1-8af2-87a701b909e0", "content": "CVE-2026-109286 Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109286https://github.com/open-webui/open-webui/security/advisories/GHSA-vpq8-f445-hcq7https://www.vulncheck.com/advisories/open-webui-0.7.0-before-0.11.4-session-token-theft-via-syncstatsmodal#open-webui#CVE_2026_109286#bot", "url": "https://infosec.exchange/users/cve/statuses/117429002942757350"}, {"timestamp": "2026-10-12T17:17:21Z", "date_only": false, "value": "2026-10-12T17:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X8QF-HM43-C9G2", "record": "GHSA-X8QF-HM43-C9G2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:21.613Z", "date_only": false, "value": "2026-10-12T17:17:21.613", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109286", "record": "FKIE_CVE-2026-109286", "field": "published"}, {"timestamp": "2026-10-12T17:17:21.613Z", "date_only": false, "value": "2026-10-12T17:17:21.613", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109286", "record": "FKIE_CVE-2026-109286", "field": "lastModified"}, {"timestamp": "2026-10-12T18:31:44Z", "date_only": false, "value": "2026-10-12T18:31:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X8QF-HM43-C9G2", "record": "GHSA-X8QF-HM43-C9G2", "field": "published"}, {"timestamp": "2026-10-12T18:31:44Z", "date_only": false, "value": "2026-10-12T18:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X8QF-HM43-C9G2", "record": "GHSA-X8QF-HM43-C9G2", "field": "modified"}, {"timestamp": "2026-10-13T04:30:04.527Z", "date_only": false, "value": "2026-10-13T04:30:04.527257Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq74fgnul2h", "record": "CVE-2026-109286", "field": "creation_timestamp", "uuid": "cc1ff9da-433e-4dbc-973a-8e19cfd4b6cb", "content": "CVE-2026-109286\nVersions of Open WebUI from 0.7.0 up to 0.11.3 let any website trick a logged\u2011in user into revealing their session token. An attacker could then act as that user and access the full API. Upgrade Open WebUI to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq74fgnul2h"}]}