Listen to this Post
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From version 0.6.41 until 0.11.1, the functions `get_user_by_oauth_sub` and `get_user_by_scim_external_id` located in `backend/open_webui/models/users.py` used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent (%) or underscore (_) wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account’s session. PostgreSQL deployments were not affected because they take a separate and correct code path. The defect is in the identity match itself, so it is not mitigated by any downstream permission check: by the time a session is issued the wrong account has already been selected. It does not allow account creation, and it does not affect password sign-in, PostgreSQL deployments, or any deployment with OAuth, OIDC and SCIM all disabled. The vulnerability is fixed in version 0.11.1 via PR open-webui/open-webui28624. The two identity lookups now compare the nested JSON value directly through SQLAlchemy’s JSON subscript operator, which emits an exact match on both supported databases, instead of going through the column-level `contains()` operator that degraded to a substring comparison on SQLite. Upgrading fully resolves it and no configuration change is required. The root cause is that the `oauth` and `scim` columns are declared with SQLAlchemy’s generic `JSON` type, which does not implement a containment comparator, so a `contains()` call against it falls back to the generic string operator and compiles to a `LIKE` with the operand wrapped in `%` on both sides.
DailyCVE Form:
Platform: Open WebUI
Version: 0.6.41-0.11.1
Vulnerability: Authentication Bypass
Severity: High
date: 2026-09-09
Prediction: 2026-09-09
What Undercode Say
Analytics:
Verify Open WebUI version pip show open-webui Check database backend cat .env | grep DATABASE_URL Query user table for stored subject values sqlite3 webui.db "SELECT id, email, oauth FROM user;"
Vulnerable code path
def get_user_by_oauth_sub(self, sub: str):
return self.db.query(User).filter(
User.oauth.contains({"sub": sub})
).first()
-- Resulting SQL on SQLite (vulnerable) SELECT FROM user WHERE oauth LIKE '%' || ? || '%'; -- Correct SQL after fix SELECT FROM user WHERE json_extract(oauth, '$.sub') = ?;
Exploit: (Educational Purposes!)
Craft OAuth subject with wildcard to match admin account Assuming admin stored subject is admin_sub_9999 Attacker uses % as subject value Expected result: session issued for administrator account curl -X POST https://target/oauth/callback \ -d "code=valid_code&sub=%"
Seeding test database
import sqlite3
conn = sqlite3.connect('webui.db')
conn.execute("INSERT INTO user (id, email, oauth) VALUES ('1', '[email protected]', '{\"sub\": \"admin_sub_9999\"}')")
conn.execute("INSERT INTO user (id, email, oauth) VALUES ('2', '[email protected]', '{\"sub\": \"bob_sub_1234\"}')")
Protection: from this CVE
Upgrade to patched version pip install --upgrade open-webui>=0.11.1 Verify patch applied pip show open-webui | grep Version
-- Verify no wildcard-vulnerable identities exist SELECT id, email FROM user WHERE oauth LIKE '%\%%' ESCAPE '\';
Mitigation via reverse proxy (nginx) - block wildcards in auth headers
if ($http_authorization ~ "[%_]") {
return 403;
}
Impact:
- Account takeover including administrator accounts
- Full compromise of Open WebUI instance
- Unauthorized access to sensitive data and AI configurations
- Non-deterministic session binding to wrong user accounts
- PostgreSQL deployments and password-based authentication unaffected
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
