Open WebUI Direct Connections SSE code injection -> ATO/RCE
Date: 2025-11
Affected: open-webui <= 0.6.34
Attack vector: xss
Category: real-world
Severity: High
CVE: CVE-2024-12534
CVE-2024-12537
CVE-2025-64495
CVE-2025-64496
CVE-2025-65958
CVE-2025-65959
CVE-2026-44721
CVE-2026-45299
CVE-2026-45331
CVE-2026-45338
CVE-2026-45339
CVE-2026-45346
CVE-2026-45349
CVE-2026-45385
CVE-2026-45386
CVE-2026-45387
CVE-2026-45395
CVE-2026-45396
CVE-2026-45397
CVE-2026-45398
CVE-2026-45399
CVE-2026-45400
CVE-2026-45401
CVE-2026-45402
CVE-2026-45665
CVE-2026-45667
CVE-2026-45671
CVE-2026-45675
CVE-2026-56399
CWE: CWE-20
CWE-200
CWE-269
CWE-306
CWE-362
CWE-400
CWE-501
CWE-639
CWE-770
CWE-79
CWE-80
CWE-829
CWE-830
CWE-862
CWE-863
CWE-915
CWE-918
CWE-95
CVSS: 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

Open WebUI <= 0.6.34: Direct Connections feature allows malicious external model servers to execute arbitrary JavaScript in victim browsers via SSE 'execute' events. Leads to account takeover and, with workspace.tools, RCE. Fixed in 0.6.35. CVSS 7.3.


Mitigations:

Architectural layers (MAESTRO):