CVE-2024-7053
| CVE ID | CVE-2024-7053 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 7.6, CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) |
The report requires a cross-origin <img>, rendered from markdown, to carry Open WebUI's cookie to an attacker-controlled server. It cannot, for four separate reasons, any one of which ends the attack on its own:
- Cookies are sent only to their own domain, so that request carries the attacker's cookies and never Open WebUI's.
- The cookie is
HttpOnly, so no script can read it. SameSite=Laxwithholds it from cross-site subresource requests such as an image.- Rendering a markdown image executes no script at all.
Authentication does not use that cookie in the first place. Open WebUI signs requests with a Bearer JWT held in localStorage. The record is published as a High-severity administrator account takeover, scored 7.6, and labelled session fixation, though there is no server-side session identifier to fix.
This is not a subtle finding that reasonable reviewers could differ on. Each of the four points above is long-settled browser behaviour, and any one of them alone ends the attack. A record was nonetheless minted, scored 7.6 High, and published against this project, where it has stood for over a year.
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the session cookie is set with SameSite=Lax and without the Secure flag. The report claims that a malicious markdown <img> embedded in a chat, when viewed by an administrator, transmits the administrator's session cookie to an attacker-controlled server, enabling a "session fixation" attack and administrator account takeover, potentially leading to remote code execution. The record classifies this as CWE-79 and scores it CVSS 7.6 (High).
Why This Is Not a Vulnerability
The described exploit chain is physically impossible. Each step below is verifiable in the code, and any one of them alone defeats the attack.
Authentication Does Not Use a Script-Readable Session Cookie
Open WebUI authenticates with a stateless Bearer JWT held in localStorage and sent in the Authorization header, not a session cookie. The token cookie that also exists is set httponly=True, so no script can read it, and rendering a markdown image executes no script in any case.
A Cross-Origin Image Cannot Exfiltrate the Cookie
The claimed exfiltration fails on three independent grounds:
- Cookies are attached only to requests to their own domain. An
<img src="https://attacker.example">request carries the attacker's cookies, never Open WebUI's. A cross-origin image can never transmit the Open WebUI cookie. - The cookie is
HttpOnly, so no script can read it, and markdown image rendering runs no script. SameSite=Laxwithholds the cookie from cross-site subresource requests such as<img>regardless.
"Session Fixation" Does Not Apply
The report is labelled session fixation, but there is no server-side session identifier to fix: the JWT is stateless and freshly minted on each sign-in. What the report actually describes is cross-origin cookie theft, which, as shown above, cannot occur.
The One Accurate Detail Is a Hardening Nit, Not This Attack
The only true atom in the report is that the fallback cookie ships without Secure / SameSite=Strict by default. That is a minor defence-in-depth hardening consideration (the cookie's SameSite is configurable in later releases), and it enables no part of the claimed attack: the exfiltration path does not exist regardless of these flags.
Severity
Because the described attack cannot occur, no CVSS score applies. The 7.6 (High) rating describes an administrator-account-takeover impact that the mechanism cannot produce.
Applicable Security Policy Rules
- Rule 1: A vulnerability must be an exploitable weakness that crosses a security boundary affecting another party. The reported chain is technically impossible, so no boundary is crossed.
Impact to Users
No action required. Open WebUI does not authenticate through a script-readable session cookie, and a cross-origin markdown image cannot transmit the authentication cookie, so the reported account-takeover chain cannot occur.