CVE-2026-88001

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:04+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w 2026-09-10 01:32:33+00:00| seen| https://gist.github.com/alon710/855b51c2ea136c7c49beab7d27d1ef40...

CVE-2026-88000

creationtimestamp| type| source ---|---|--- 2026-09-10 00:32:33+00:00| seen| https://gist.github.com/alon710/48cdccd93c734ae28b1351fbe3368bd9 2026-09-10 00:35:02+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89454

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.11.0 Description The OAuth token exchange endpoint in backend/open webui/routers/auths.py issues a session for a provider access token without executing the OAuth role management checks performed by the...

The vulnerability of the /oauth/backchannel-logout web interface based on artificial intelligence in Open WebUI allows a perpetrator to trigger a service failure.

The vulnerability of the /oauth/backchannel-logout web interface component in the Open WebUI system is related to asymmetric resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

PT-2026-89453

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.8.9 Description The OAuth token exchange endpoint in backend/open webui/routers/auths.py fails to apply the email domain allowlist that is normally enforced during the OAuth login callback. This occurs becau...

CVE-2026-88005: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

CVE-2026-88006: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

Infinite loop

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Infinite loop through the chat-history message deletion helper process. An attacker can cause the server to hang and deny service to all users by creating a cyclic chat tree and deleting a message, resulting ...

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

EUVD-2026-75185

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree...

EUVD-2026-75187

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the fetch process when HTTP redirects are followed and the destination of the redirect is not validated against excluded hosts or private/internal address checks. An attack...

GHSA-5X7X-4C3C-QF5W Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

EUVD-2026-75188

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history...

Infinite loop

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Infinite loop in the message-chain reconstruction process. An attacker can cause the server to hang and consume excessive resources by submitting a chat history with cyclic parent references and omitted id...

GHSA-JQHH-CJMQ-VMV6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...