CVE-2024-7053

CVE-2024-7053 is a critical session fixation vulnerability in Open WebUI version 0.3.8, allowing a user-level attacker to hijack administrator sessions. The vulnerability stems from insecure session cookie handling, specifically the lack of a Secure flag and a default SameSite=Lax setting, enabling cookies to be sent over HTTP to cross-origin domains. An attacker can exploit this by embedding a malicious image in a chat, leading to administrator account takeover and potential remote code execution. With a CVSS score of 9.0 (CRITICAL), this vulnerability is easily exploitable with low attack complexity, requiring user interaction. There is currently no public exploit code, active exploitation, or significant community discussion reported.