Session-Fixation
- Session Fixation in Open WebUI
Open WebUI 0.3.8 issues session cookies without the Secure flag and with SameSite set to Lax, which lets a low-privileged attacker carry out a session fixation attack.
Open WebUI 0.3.8 issues session cookies without the Secure flag and with SameSite set to Lax, which lets a low-privileged attacker carry out a session fixation attack.