MEDIUM 6.3 GitHub
CVE-2026-70490
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
## Summary
The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that `get_verified_user` enforces on every HTTP terminal route. An account whose role is `pending`, meaning registered but not approved, or approved and later deactivated back to `pending`, can therefore open an interactive terminal session that the HTTP terminal endpoints would refuse. The missing control is the verified-user role g
Affected Products
- pip/open-webui >= 0.8.8, < 0.11.0
References
- https://github.com/advisories/GHSA-5gpj-vj23-vhhv
- https://github.com/open-webui/open-webui/security/advisories/GHSA-5gpj-vj23-vhhv
- https://github.com/advisories/GHSA-5gpj-vj23-vhhv
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-08-04 via GitHub. Affected: pip/open-webui >= 0.8.8, < 0.11.0.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.