CVE-2026-106460

The @backstage/plugin-auth-node package in the Backstage framework (versions 0.3.0 through 0.6.15 and 0.7.5) fails to consistently honor explicit negative email verification during shared OAuth profile normalization. Specifically, it may ignore verified: false or email_verified: false claims in c...

watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127

watchTowr-vs-f5-bigip-PreAuth-RCE Detection Artifact Generator for F5 BIG-IP See our blog post for technical details. Detection in Action ./watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127.py --host 192.168.5.36 --port 80 --command 'touch /tmp/hello' all the offsets/addresses are hardcoded for...

Exploit for Heap-based Buffer Overflow in F5 Big-Ip_Access_Policy_Manager

watchTowr-vs-f5-bigip-PreAuth-RCE Detection Artifact Generato...

Vulnerability concealment in F5 Networks BIG-IP Access Policy Manager

F5 Networks has identified a vulnerability in BIG-IP Access Policy Manager APM. This vulnerability allows unauthorized malicious actors to execute malicious code. To do this, the malicious actor needs to send malicious network traffic to the vulnerable system. BIG-IP APM systems are only vulnerab...

CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager APM. The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attacker with network access to an affected...

CVE-2026-94127

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

EUVD-2026-84427

When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution RCE. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also...

CVE-2026-94127

F5 BIG-IP APM is affected by a heap-based buffer overflow (CWE-122) that allows an unauthenticated attacker to achieve remote code execution (RCE) . This vulnerability is specific to configurations where both an APM access policy and an OAuth profile are active on a virtual server, specifically w...

CVE-2026-94127 BIG-IP APM OAuth vulnerability

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

CVE-2026-94127 BIG-IP APM OAuth vulnerability

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

K000162605: BIG-IP APM vulnerability CVE-2026-94127

Security Advisory Description When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments...

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution...

Open WebUI: DNS Rebinding SSRF Bypass

SummaryOpen WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

CVE-2026-54020

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

SummaryA Server-Side Request Forgery SSRF vulnerability exists in processpictureurl in backend/openwebui/utils/oauth.py line 1338. The function fetches arbitrary URLs from OAuth picture claims without applying validateurl, allowing an attacker to force the server to make HTTP requests to internal...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processpictureurl function. An attacker can access internal network resources and exfiltrate sensitive data by submitting a crafted OAuth profile image URL that redirec...

PT-2026-50480

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description An issue exists where the process picture url function in backend/open webui/utils/oauth.py performs URL validation only on the initial URL. Subsequently, it uses aiohttp.ClientSession.get without...

CVE-2026-45338 Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a Server-Side Request Forgery SSRF vulnerability exists in processpictureurl in backend/openwebui/utils/oauth.py line 1338. The function fetches arbitrary URLs from OAuth picture...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the OAuthManager profile picture fetch path in the OAuth handling code. An attacker can make the server send outbound requests to arbitrary URLs by supplying a malicio...