CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

src/lib/components/chat/FileNav/PortPreview.svelte shows the content of a previewed terminal port in an iframe. Its sandbox string always included allow-same-origin next to allow-scripts, and the terminal proxy serves the content from a path on Open WebUI's own origin. With that combination the sandbox isolates nothing. The page can reach window.parent, read the session token from localStorage and send it to the attacker's host.

The attacker is a normal authenticated user with access to a terminal connection an admin configured (TERMINAL_SERVER_CONNECTIONS, empty by default), who can start a process listening on a port there. The victim must open the port list and click that port, which is the user interaction. If the victim is an admin, or holds workspace.functions, the takeover reaches server-side code execution through Functions.

Limits: instances with no terminal server are not affected, and neither are personal terminals with an external URL, where the previewed document is cross-origin. A restrictive Content-Security-Policy (set through CONTENT_SECURITY_POLICY or TERMINAL_PROXY_HEADERS) also protected operators. The iframeSandboxAllowSameOrigin user setting was ignored on this branch.

Affected: open-webui 0.8.11 through 0.11.0, on instances with at least one admin-configured shared terminal server reachable by several users. Check:

pip show open-webui

Check whether TERMINAL_SERVER_CONNECTIONS is set.

Upgrade to Open WebUI 0.11.1. No configuration change is needed.

pip install --upgrade "open-webui>=0.11.1"

The port preview now gates allow-same-origin behind a terminalPreviewAllowSameOrigin user setting that is off by default, so the preview loads at an opaque origin. A user who turns the setting on brings back the risk for that user. The sources give no other workaround; a restrictive Content-Security-Policy and not sharing terminal servers with untrusted users lower the exposure.

Review which processes listen on ports of your shared terminal servers, and which users started them. Check web logs for requests to the terminal proxy path from preview iframes followed by outbound traffic to unknown hosts. Watch for session tokens used from new IP addresses, and review admin and Functions changes made after a user clicked a port preview.

Summary

Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and that content is served from a path on the application's own origin, so the sandbox provided no isolation at all. Script served on a previewed port could read the victim's session token and take over the account.

Preconditions

• At least one terminal server configured by an admin (TERMINAL_SERVER_CONNECTIONS, empty by default) and reachable by both the attacker and the victim. Deployments with no terminal server configured are not affected.
• The attacker needs a normal authenticated account with access to that terminal connection, no admin rights, plus the ability to start a process listening on a port there.
• Personal terminals a user configures for themselves are not affected. Those carry an external URL, so the previewed document is cross-origin and the sandbox held.
• The victim has to open the port list and click the attacker's port.
• TERMINAL_PROXY_HEADERS unset and no CONTENT_SECURITY_POLICY set, which are the defaults. An operator who had already set a restrictive Content-Security-Policy through either was not exposed, since those headers apply to the proxied response.
• The iframeSandboxAllowSameOrigin user setting is off by default, but the affected branch ignored it entirely.

Impact

The previewed page runs in the application origin, so it can reach the parent window, read the session token out of localStorage and exfiltrate it, which is full account takeover of the victim. If the victim is an admin, or any user holding workspace.functions, that takeover extends to server-side code execution through Functions. Serving the page costs the attacker nothing beyond the terminal access they already hold, so the only real barrier is getting the victim to open that port. Instances with no terminal server configured were never affected, and neither were personal terminals pointed at an external URL.

Fix

Fixed in 0.11.1 by 54d7a2237. The port preview now gates allow-same-origin behind a terminalPreviewAllowSameOrigin user setting that is off by default, so the preview loads at an opaque origin and cannot reach the parent context. Upgrading is sufficient and no configuration change is required. Previews of pages that need same-origin access still work if a user turns that setting on, and doing so re-enables the behaviour described here for that user.

Root cause

• src/lib/components/chat/FileNav/PortPreview.svelte, the preview iframe, reached by clicking a port in the file navigator's port list.
• Present from 0.8.11, the first release containing the component, through 0.11.0.

Every other iframe in the application had already been moved to an opt-in same-origin setting. The port preview kept a static sandbox string with allow-same-origin baked into it, and it was missed when the equivalent problem was fixed in the file preview for 0.11.0. Because the terminal proxy is mounted under the application's own origin and forwards the upstream response and its content type without adding a Content-Security-Policy of its own unless the operator configured one, and no global CSP is set, the sandbox was the only isolation boundary left, and it was granting precisely the permission that dissolved it.

Proof of concept

On a terminal server the victim can also reach, serve an HTML page containing a script that reads window.parent.localStorage.token and sends it to a host the attacker controls. The victim opens the file navigator, switches to the port list and clicks that port. The preview opens, the script executes at the application origin, and the token is exfiltrated.

Credits

Reported by @manus-use (researcher zx / Jace).