What happened
Two of the highest-severity items in a large batch of Open WebUI CVEs disclosed 2026-09-09/10: an iframe sandbox misconfiguration allowing same-origin script execution from previewed terminal content (CVSS 8.7), and a SQL substring-matching bug in OAuth/SCIM user lookup that can let an attacker's OAuth identity match and hijack an existing account (CVSS 8.1).
Why it matters
Open WebUI is one of the most widely deployed self-hosted front-ends for local and API-based LLMs; a same-origin sandbox escape or an OAuth account-takeover path both enable full session/account compromise for any admin or user of an exposed instance, extending to any connected model credentials or knowledge bases.
Attack vector
CVE-2026-87995: PortPreview.svelte renders terminal port content in an iframe sandbox with both allow-scripts and allow-same-origin set; because the terminal proxy serves same-origin content, a malicious page in the preview can execute script with the full origin's privileges. CVE-2026-87016: OAuth-subject and SCIM-external-ID lookups use JSON-contains matching that compiles down to SQL LIKE substring matching on SQLite, allowing a crafted OAuth subject to match an unintended existing user account and take over that account.
Affected systems
Open WebUI, versions 0.8.11 through 0.11.1 (CVE-2026-87995); 0.6.41 through 0.11.1 (CVE-2026-87016)
Mitigation
Upgrade to Open WebUI 0.11.2 or later, which fixes both issues (and the broader cluster of CVE-2026-87xxx/88xxx Open WebUI advisories disclosed the same week). See vendor commits.