Open WebUI Terminal Proxy Bug (CVE-2026-59224) Lets Attackers Hijack User Sessions

A newly disclosed vulnerability in Open WebUI’s terminal proxy component could allow an authenticated attacker to impersonate other users and potentially attach to their live terminal sessions.

Tracked as CVE-2026-59224 and rated High severity, the flaw stems from a spoofable, integrity-unbound user identity forwarded to upstream terminal infrastructure.

The advisory, GHSA-j657-m4c4-24jq, was published last week by doge-woof and consolidates independent findings from researchers smoke-wolf and rexpository. It affects all open-webui pip package versions prior to 0.10.0.

Open WebUI Terminal Proxy Bug

The issue lives in backend/open_webui/routers/terminals.py, which handles two proxy paths for terminal access: an HTTP path (proxy_terminal) and a WebSocket path (ws_terminal). Both forward a user’s identity to the upstream backend coordinator, but neither cryptographically binds that identity to the session that produced it.

On the HTTP path, the proxy sets headers['X-User-Id'] = user.id and sends it unsigned. Any upstream that trusts this header as proof of identity is vulnerable to spoofing, provided an attacker can reach it directly, through a compromised peer, or via SSRF.

The WebSocket path is more dangerous because it requires no external access at all. The code builds the upstream URL like this: upstream_url=f′{ws_base}/p/{policy_id}/api/terminals/{session_id}′

followed by appending ?user_id=<caller> via urllib.parse.urlencode. The critical flaw: session_id is never sanitized or URL-encoded on this path, unlike its HTTP sibling, which runs _sanitize_proxy_path.

An attacker can smuggle an encoded ? or & inside session_id. Open WebUI decodes it once, passes it along, and the upstream decodes it again, injecting an attacker-controlled user_id parameter that lands ahead of the legitimate one.

Since query parsers bind to the first occurrence, the backend coordinator resolves the attacker’s spoofed identity rather than the real caller’s.

On deployments using policy_id-based backend coordinators that scope terminal containers by user ID, this flaw lets an attacker’s proxied request resolve to another user’s terminal scope.

Combined with a known session ID, which could be exposed through something as simple as a shared chat link an attacker could attach to that victim’s live PTY session, gaining full read/write access to an active terminal.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) reflects network-based attack access, high complexity, low privilege requirements, required user interaction, and severe impacts on confidentiality, integrity, and availability once exploited.

Mitigation

GitHub’s advisory outlines two remediation layers. First, sanitize input: validate and URL-encode session_id using urllib.parse.quote(session_id, safe=""), rejecting characters like ?, #, &, /, %, backslashes, and control characters before constructing the upstream URL.

Query strings should be built using a dedicated URL builder so that path content never precedes or contaminates parameters.

Second, and more fundamentally, stop passing raw user_id values as trust anchors. The advisory recommends emitting a short-lived signed claim, for example, HS256-signed JSON containing {uid, iat, aud:server_id} using a key shared only with the specific upstream, which then verifies the signature before granting terminal access.

The fix landed in open-webui 0.10.0, credited to remediation developer Classic298. Organizations running self-hosted Open WebUI instances with terminal functionality enabled, particularly those using backend coordinator/policy_id configurations should upgrade immediately and audit terminal access logs for anomalous cross-user session activity.