Open WebUI: Unauthenticated requests can stall the server

Published September 10, 2026 CVE-2026-87011

Open WebUI can stop answering requests when someone sends repeated invalid logout messages. The flaw affects availability, not data confidentiality or integrity.

Severity
HighCVSS 3.1 · 7.5
Fix
Update availableFix recorded today
Affected versions
0.9.0 or newer, but before 0.11.1
Weakness
CWE-405
Exploit likelihood
0.34% in 30 daysEPSS, higher than 27% of known flaws
Affects
open-webui

How it works

  • The logout endpoint accepts requests without a login because identity providers call it directly.
  • Before checking each logout token, Open WebUI repeatedly downloads provider details and signing keys.
  • Those downloads were not reused, and one blocked the server's main event loop.
  • Enough requests could stall the instance.

What to do

Run python3 -m pip show open-webui and compare the installed version with 0.11.1. Also confirm whether back-channel logout and an OIDC provider are configured.

Run this in the application environment you want to check:

python3 -m pip show open-webui

Upgrade the open-webui package to version 0.11.1.

Technical details

CVE-2026-87011 is an availability flaw in Open WebUI's OIDC back-channel logout handler. Unauthenticated requests triggered repeated discovery and signing-key fetches before token validation, while the signing-key lookup blocked the async event loop.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source