CVE-2026-45675
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 had a vulnerability in the LDAP and OAuth authentication flows. They used a TOCTOU pattern, which could lead to unauthorized assignment of the admin role to the first user.
Risk Assessment
Organizations may be exposed to unauthorized access to the admin account, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to version 0.9.0 or later to eliminate this vulnerability and ensure proper security in authentication processes.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment "Insert with default role first to avoid TOCTOU race", but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.