Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

🗓️ 01 Oct 2026 16:38:30Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 2 Views

Unauthenticated DoS in Open WebUI via uncached OIDC fetches in back-channel logout.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the /oauth/backchannel-logout web interface based on artificial intelligence in Open WebUI allows a perpetrator to trigger a service failure.	10 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-87011	9 Sep 202621:59	–	circl
CVE	CVE-2026-87011	9 Sep 202620:54	–	cve
Cvelist	CVE-2026-87011 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout	9 Sep 202620:54	–	cvelist
EUVD	EUVD-2026-75170	10 Sep 202622:44	–	euvd
Github Security Blog	Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout	10 Sep 202622:44	–	github
NVD	CVE-2026-87011	9 Sep 202621:17	–	nvd
OSV	GHSA-3G9Q-V48F-HH9W Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout	10 Sep 202622:44	–	osv
OSV	PYSEC-2026-4117 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-89158	26 Aug 202600:00	–	ptsecurity

Vulners

Node

pypi open-webuiRange0.9.0–0.11.1

Source	Link
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-87011
github	www.github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c
github	www.github.com/open-webui/open-webui
github	www.github.com/open-webui/open-webui/releases/tag/v0.11.1
pypi	www.pypi.org/project/open-webui
github	www.github.com/advisories/GHSA-3g9q-v48f-hh9w

01 Oct 2026 17:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00644

SSVC