CVE-2024-7053
| CVE ID | CVE-2024-7053 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 7.6, CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) |
The report requires a cross-origin <img>, rendered from markdown, to carry Open WebUI's cookie to an attacker-controlled server. It cannot, for four separate reasons, any one of which ends the attack on its own:
- Cookies are sent only to their own domain, so that request carries the attacker's cookies and never Open WebUI's.
- The cookie is
HttpOnly, so no script can read it. SameSite=Laxwithholds it from cross-site subresource requests such as an image.- Rendering a markdown image executes no script at all.
Authentication does not use that cookie in the first place. Open WebUI signs requests with a Bearer JWT held in localStorage. The record is published as a High-severity administrator account takeover, scored 7.6, and labelled session fixation, though there is no server-side session identifier to fix.
Each of the four points above is long-settled browser behaviour, and any one of them alone ends the attack. The record was nonetheless minted, scored 7.6 High, and published against this project, where it has stood for over a year.
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
This CVE was withdrawn by its issuing CNA after the dispute was escalated to the CVE Program. Open WebUI's assessment below is the basis on which the record was rejected.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
| 2026-08-12 | The CVE Program opens a formal dispute with huntr / Protect AI under CVE Program Rule 4.1 (Vulnerability Determination) and requests the CNA's response. |
| 2026-08-12 | huntr / Protect AI replies to the CVE Program and agrees to withdraw the record. |
| 2026-08-13 | Officially rejected The record is updated on cve.org. The CVE record is now officially REJECTED. |
| Still open | The huntr report page has not followed the withdrawal. The report is still shown as Valid with a green check and its status as "Awaiting fix", while the CVE field on the same page reads Rejected. |
| 2026-08-14 | With the report status unchanged, Open WebUI raises the matter with the CVE Program, asking that records withdrawn by the CNA no longer be presented as valid and awaiting a fix. CNA Rule 4.5.2.3 states that a CNA's published vulnerability information "MUST generally support and MUST NOT contradict information published by the CNA in corresponding CVE Records". |
The record is now in the REJECTED state on cve.org, and that state propagates to NVD and downstream feeds. No action is required from users, and the CVE should not be treated as an Open WebUI vulnerability.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the session cookie is set with SameSite=Lax and without the Secure flag. The report claims that a malicious markdown <img> embedded in a chat, when viewed by an administrator, transmits the administrator's session cookie to an attacker-controlled server, enabling a "session fixation" attack and administrator account takeover, potentially leading to remote code execution. The record classifies this as CWE-79 and scores it CVSS 7.6 (High).
Why This Is Not a Vulnerability
Nothing below rests on how Open WebUI draws its threat model, on configuration, or on where a security boundary is placed. It rests on what the cited code does, in the affected version as published, and it would hold under any threat model at all.
The credential the attack chases is not the one that signs the application's requests, drawing an image in a chat runs no script, and a request to another site carries that site's cookies rather than this one's. Each step below is verifiable in the code, and any one of them alone ends the attack.
Authentication Does Not Use a Script-Readable Session Cookie
Open WebUI authenticates with a stateless Bearer JWT held in localStorage and sent in the Authorization header, not a session cookie. The token cookie that also exists is set httponly=True, so no script can read it, and rendering a markdown image executes no script in any case.
A Cross-Origin Image Cannot Exfiltrate the Cookie
The claimed exfiltration fails on three independent grounds:
- Cookies are attached only to requests to their own domain. An
<img src="https://attacker.example">request carries the attacker's cookies, never Open WebUI's. A cross-origin image can never transmit the Open WebUI cookie. - The cookie is
HttpOnly, so no script can read it, and markdown image rendering runs no script. SameSite=Laxwithholds the cookie from cross-site subresource requests such as<img>regardless.
"Session Fixation" Does Not Apply
The report is labelled session fixation, but there is no server-side session identifier to fix: the JWT is stateless and freshly minted on each sign-in. What the report actually describes is cross-origin cookie theft, which, as shown above, cannot occur.
The One Accurate Detail Is a Hardening Nit, Not This Attack
The only true atom in the report is that the fallback cookie ships without Secure / SameSite=Strict by default. That is a minor defence-in-depth hardening consideration (the cookie's SameSite is configurable in later releases), and it enables no part of the claimed attack: the exfiltration path does not exist regardless of these flags.
Severity
Because the described attack cannot occur, no CVSS score applies. The 7.6 (High) rating describes an administrator-account-takeover impact that the mechanism cannot produce.
Applicable Security Policy Rules
- Rule 1: A vulnerability must be an exploitable weakness that crosses a security boundary affecting another party. The reported chain is technically impossible, so no boundary is crossed.
- Rule 3: Reports must reflect an understanding of the affected components. The record rests on a session cookie carrying the sign-in credential, when the application signs its requests with a token the page holds separately and sends in a header, so the credential the described attack chases is not the one that authenticates anything.
- Rule 8: A submitted score must reflect the finding accurately. The record is scored as a high-severity takeover of an administrator account, an outcome the described mechanism cannot produce at any of its steps.
Impact to Users
No action required. Open WebUI does not authenticate through a script-readable session cookie, and a cross-origin markdown image cannot transmit the authentication cookie, so the reported account-takeover chain cannot occur.