openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44555 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44555 Source advisory: GHSA-9VVH-QMJX-P4Q8...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44555 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44555 Source advisory: SNYK:PYTHON-OPENWEBUI-16599152...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44552 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44552 Source advisory: SNYK:PYTHON-OPENWEBUI-16599148...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44552 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44552 Source advisory: GHSA-3X8W-4F7P-XXC2...

GHSA-3X8W-4F7P-XXC2 Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

Redis Cache Keys toolservers and terminalservers Missing Instance Prefix Enable Cross-Instance Cache Poisoning Affected Component Tool server and terminal server Redis cache: - backend/openwebui/utils/tools.py line 841, toolservers SET - backend/openwebui/utils/tools.py line 850, toolservers GET ...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44552 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44552 Source advisory: OSV:GHSA-3X8W-4F7P-XXC2...

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

Redis Cache Keys toolservers and terminalservers Missing Instance Prefix Enable Cross-Instance Cache Poisoning Affected Component Tool server and terminal server Redis cache: - backend/openwebui/utils/tools.py line 841, toolservers SET - backend/openwebui/utils/tools.py line 850, toolservers GET ...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44553 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44553 Source advisory: GHSA-45M8-CPM2-3V65...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44553 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44553 Source advisory: SNYK:PYTHON-OPENWEBUI-16599150...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44553 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44553 Source advisory: OSV:GHSA-45M8-CPM2-3V65...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the createfolder process. An attacker can create unauthorized folders in another user's account, potentially flooding the victim's folder tree or planting phishing content, by...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44550 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44550 Source advisory: GHSA-HR43-RJMR-7WMM...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44550 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44550 Source advisory: SNYK:PYTHON-OPENWEBUI-16599158...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44550 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44550 Source advisory: OSV:GHSA-HR43-RJMR-7WMM...

GHSA-2R4P-JPMG-48F4 Open WebUI has an LDAP Empty Password Authentication Bypass

LDAP Empty Password Authentication Bypass Affected Component LDAP authentication endpoint: - backend/openwebui/routers/auths.py lines 468-477, user bind with empty password - backend/openwebui/models/auths.py lines 58-60, LdapForm model Affected Versions Current main branch commit 6fdd19bf1 and...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44551 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44551 Source advisory: SNYK:PYTHON-OPENWEBUI-16599159...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44551 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44551 Source advisory: GHSA-2R4P-JPMG-48F4...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44551 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44551 Source advisory: OSV:GHSA-2R4P-JPMG-48F4...

Improper Authentication

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Authentication in the LdapForm process. An attacker can gain unauthorized access to any LDAP user account, including administrative accounts, by submitting a valid username with an empty password to...

GHSA-GF5M-WCRH-7928 open-webui Vulnerable to Stored XSS via Model Description

!IMPORTANT Relationship to CVE-2024-7990 CVE-2024-7990 issued by huntr.dev, March 2025 describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder...