High
github
·
GHSA-v2qm-5wxj-qhj7
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Published Jun 17, 2026
CVSS 7.6
Stored XSS to Account Takeover via Model Profile Images in Open WebUI
Affected: Open WebUI token theft via Open WebUI model profile image
Affected: open-webui
Affected AI Products
gpt-4