https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:07:17 +0000 https://db.gcve.eu/vuln/cve-2026-44551 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.</p> https://db.gcve.eu/vuln/cve-2026-44551 https://db.gcve.eu/vuln/ghsa-2r4p-jpmg-48f4 <p><strong>Affected:</strong> PyPI: open-webui</p> <p># LDAP Empty Password Authentication Bypass</p> <p>## Affected Component</p> <p>LDAP authentication endpoint: - `backend/open_webui/routers/auths.py` (lines 468-477, user bind with empty password) - `backend/open_webui/models/auths.py` (lines 58-60, `LdapForm` model)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions with LDAP authentication support.</p> <p>## Description</p> <p>The LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. Per RFC 4513 Section 5.1.2, a Simple Bind with a valid DN and an empty password constitutes an &#34;unauthenticated simple authentication&#34; — many LDAP servers (including OpenLDAP in default configuration and some Active Directory setups) return success (resultCode 0) for this operation.</p> <p>The `LdapForm` Pydantic model accepts `password: str` with no minimum length constraint, so an empty string passes validation. The subsequent `Connection.bind()` call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user.</p> <p>```python # models/auths.py:58-60 — no min_length on password class LdapForm(BaseModel): user: str password: str</p> <p># auths.py:469-477 — empty password reaches LDAP bind connection_user = Connection( server, user_dn, form_data.password, # can be &#34;&#34; auto_bind=&#39;NONE&#39;, authentication=&#39;SIMPLE&#39;, ) if not await asyncio.to_thread(connection_user.bind): raise HTTPExcep…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p># LDAP Empty Password Authentication Bypass</p> <p>## Affected Component</p> <p>LDAP authentication endpoint: - `backend/open_webui/routers/auths.py` (lines 468-477, user bind with empty password) - `backend/open_webui/models/auths.py` (lines 58-60, `LdapForm` model)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions with LDAP authentication support.</p> <p>## Description</p> <p>The LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. Per RFC 4513 Section 5.1.2, a Simple Bind with a valid DN and an empty password constitutes an &#34;unauthenticated simple authentication&#34; — many LDAP servers (including OpenLDAP in default configuration and some Active Directory setups) return success (resultCode 0) for this operation.</p> <p>The `LdapForm` Pydantic model accepts `password: str` with no minimum length constraint, so an empty string passes validation. The subsequent `Connection.bind()` call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user.</p> <p>```python # models/auths.py:58-60 — no min_length on password class LdapForm(BaseModel): user: str password: str</p> <p># auths.py:469-477 — empty password reaches LDAP bind connection_user = Connection( server, user_dn, form_data.password, # can be &#34;&#34; auto_bind=&#39;NONE&#39;, authentication=&#39;SIMPLE&#39;, ) if not await asyncio.to_thread(connection_user.bind): raise HTTPExcep…</p> https://db.gcve.eu/vuln/ghsa-2r4p-jpmg-48f4