Listen to this Post
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race in LDAP and OAuth authentication flows when assigning the first admin role on a fresh instance.
In both LDAP (auths.py, lines 479-490) and OAuth (oauth.py, lines 1103-1112 & 1566-1574), the code first checks if the user table is empty (Users.has_users() or Users.get_num_users() == 0).
If empty, it sets `role = ‘admin’`.
Then, after this check, it inserts the new user with that pre‑determined role.
The race window exists because multiple concurrent requests can all see an empty table before any insert commits.
The regular signup handler was patched with an insert‑then‑check pattern (line 663) to avoid this, but LDAP and OAuth were never updated.
`DATABASE_ENABLE_SESSION_SHARING` defaults to False, so each request uses its own database session, widening the race window.
An attacker can send many concurrent first‑login requests (e.g., via LDAP/OAuth) on a fresh deployment.
All requests that pass the empty‑check simultaneously will create admin users.
This escalates every concurrent user to full administrator privileges.
The fix (PR 23626, commit 96a0b3239, v0.9.0, Apr 2026) changes both paths to:
1. Insert new user with `DEFAULT_USER_ROLE` unconditionally.
- After insert, atomically check if total users == 1.
- If true, upgrade that sole user to admin.
Thus, only one concurrent request becomes admin; others remain default role.
dailycve form:
Platform: Open WebUI
Version: Before 0.9.0
Vulnerability: TOCTOU race admin
Severity: Critical
date: 2026-05-14
Prediction: Patch Apr 2026
What Undercode Say:
Simulate race condition with concurrent curl requests
for i in {1..10}; do
curl -X POST https://target/auth/ldap/login \
-d 'username=attacker$i&password=pass' &
done
wait
Check number of admins after race
sqlite3 webui.db "SELECT COUNT() FROM users WHERE role='admin';"
Exploit:
Send multiple parallel LDAP/OAuth authentication requests to a fresh Open WebUI instance before any user exists. Each request sees zero users, assigns `admin` role, and creates an admin user. All concurrent attackers become admins.
Protection from this CVE:
Upgrade to Open WebUI v0.9.0 or later. If patching not possible, disable LDAP/OAuth until upgrade, or enforce sequential first‑user creation with external coordination (e.g., manual initial admin setup).
Impact:
Full system compromise: attackers gain admin access to all user data, API keys, LLM backends, system configuration, and can modify/deploy models, exfiltrate secrets, or pivot to connected infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
