GHSA-3G9Q-V48F-HH9W
Vulnerability from github – Published: 2026-09-10 22:44 – Updated: 2026-09-10 22:44Summary
The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network, and repeated both fetches on every request because nothing was cached. The signing-key fetch also ran as a blocking call inside the async event loop. A small number of requests carrying a worthless token was therefore enough to make the whole instance stop answering.
Preconditions
ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true. The default isFalse, so a stock deployment is not affected. This setting is recommended in the Open WebUI hardening documentation, which is why the issue is treated as in scope.- At least one OIDC provider configured (
OAUTH_CLIENT_ID,OAUTH_CLIENT_SECRET,OPENID_PROVIDER_URL). - No account, credential, session or secret identifier is required. The attacker needs network access to the instance and the configured issuer string, which is published in the provider's own discovery document.
Impact
Against 0.11.0, with the identity provider answering in 150 ms, 60 concurrent requests carrying a token whose signature was four characters long stalled the async event loop for 8.3 seconds, measured against an idle baseline of 10.8 ms. For the length of that stall the process answers nothing: no chat requests, no API calls, no health check. Open WebUI runs a single worker by default, so the effect is instance-wide rather than per-connection, and no rate limit sits in front of the endpoint.
The same traffic is also amplified outward: 20 sequential requests produced 20 discovery fetches and 40 key-set fetches at the identity provider, so an attacker can drive load onto the provider through the instance.
No data is read, modified or exposed, and the forged token is still rejected. The cost is paid before the rejection.
Fix
Fixed in 0.11.1. The handler now resolves both the discovery document and the signing keys through the already-configured OAuth client, so each is fetched once per provider and reused afterwards, and both fetches are asynchronous rather than blocking the event loop. A token carrying no kid header is rejected before any key lookup happens. Upgrading is sufficient, and no configuration change is required.
Root cause
Affected component: the OIDC back-channel logout handler in backend/open_webui/utils/oauth.py, reached through POST /oauth/backchannel-logout. Affected setups: releases 0.9.0 through 0.11.0 with back-channel logout enabled and an OIDC provider configured.
The handler treated its network work as cheap preparation rather than as work worth protecting. For every request it opened a new HTTP session per configured provider to re-read the discovery document, then constructed a fresh JWKS client, whose own cache consequently started empty each time, and asked that client for the signing key through a synchronous call issued directly on the event loop. All of this ran before the token signature was verified, so an attacker unable to produce a valid token still cost the server two network round trips and a blocked loop per request. Both fetches used the library default timeout of five minutes.
Proof of concept
Reproduced by running the unmodified handler from the 0.11.0 and 0.11.1 backends against a loopback identity provider that counted every inbound request and could answer with a configured delay. The submitted token carried a valid issuer and audience, a kid naming a key the provider does not hold, and AAAA as its signature.
20 sequential requests, provider answering immediately:
| Version | Discovery fetches | Key-set fetches | Response |
|---|---|---|---|
| 0.11.0 | 20 | 40 | 400 |
| 0.11.1 | 1 | 1 | 400 |
60 concurrent requests, provider answering in 150 ms:
| Version | Wall time | Discovery fetches | Key-set fetches | Worst event-loop stall |
|---|---|---|---|---|
| 0.11.0 | 18.6 s | 60 | 120 | 8255 ms |
| 0.11.1 | under 0.01 s | 0 | 0 | none measurable |
Idle event-loop stall was 10.8 ms in both cases. On 0.11.1 the first request an instance receives warms both caches, and every request after that reaches the signature check without any outbound network call.
Credits
@galanko, for reporting the issue and identifying both the missing caching and the blocking call.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.11.0"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.0"
},
{
"fixed": "0.11.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-87011"
],
"database_specific": {
"cwe_ids": [
"CWE-405",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T22:44:42Z",
"nvd_published_at": "2026-09-09T21:17:05Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider\u0027s discovery document and its signing keys over the network, and repeated both fetches on every request because nothing was cached. The signing-key fetch also ran as a blocking call inside the async event loop. A small number of requests carrying a worthless token was therefore enough to make the whole instance stop answering.\n\n## Preconditions\n\n- `ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true`. The default is `False`, so a stock deployment is not affected. This setting is recommended in the Open WebUI hardening documentation, which is why the issue is treated as in scope.\n- At least one OIDC provider configured (`OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`, `OPENID_PROVIDER_URL`).\n- No account, credential, session or secret identifier is required. The attacker needs network access to the instance and the configured issuer string, which is published in the provider\u0027s own discovery document.\n\n## Impact\n\nAgainst 0.11.0, with the identity provider answering in 150 ms, 60 concurrent requests carrying a token whose signature was four characters long stalled the async event loop for 8.3 seconds, measured against an idle baseline of 10.8 ms. For the length of that stall the process answers nothing: no chat requests, no API calls, no health check. Open WebUI runs a single worker by default, so the effect is instance-wide rather than per-connection, and no rate limit sits in front of the endpoint.\n\nThe same traffic is also amplified outward: 20 sequential requests produced 20 discovery fetches and 40 key-set fetches at the identity provider, so an attacker can drive load onto the provider through the instance.\n\nNo data is read, modified or exposed, and the forged token is still rejected. The cost is paid before the rejection.\n\n## Fix\n\nFixed in 0.11.1. The handler now resolves both the discovery document and the signing keys through the already-configured OAuth client, so each is fetched once per provider and reused afterwards, and both fetches are asynchronous rather than blocking the event loop. A token carrying no `kid` header is rejected before any key lookup happens. Upgrading is sufficient, and no configuration change is required.\n\n## Root cause\n\nAffected component: the OIDC back-channel logout handler in `backend/open_webui/utils/oauth.py`, reached through `POST /oauth/backchannel-logout`. Affected setups: releases 0.9.0 through 0.11.0 with back-channel logout enabled and an OIDC provider configured.\n\nThe handler treated its network work as cheap preparation rather than as work worth protecting. For every request it opened a new HTTP session per configured provider to re-read the discovery document, then constructed a fresh JWKS client, whose own cache consequently started empty each time, and asked that client for the signing key through a synchronous call issued directly on the event loop. All of this ran before the token signature was verified, so an attacker unable to produce a valid token still cost the server two network round trips and a blocked loop per request. Both fetches used the library default timeout of five minutes.\n\n## Proof of concept\n\nReproduced by running the unmodified handler from the 0.11.0 and 0.11.1 backends against a loopback identity provider that counted every inbound request and could answer with a configured delay. The submitted token carried a valid issuer and audience, a `kid` naming a key the provider does not hold, and `AAAA` as its signature.\n\n20 sequential requests, provider answering immediately:\n\n| Version | Discovery fetches | Key-set fetches | Response |\n| --- | --- | --- | --- |\n| 0.11.0 | 20 | 40 | 400 |\n| 0.11.1 | 1 | 1 | 400 |\n\n60 concurrent requests, provider answering in 150 ms:\n\n| Version | Wall time | Discovery fetches | Key-set fetches | Worst event-loop stall |\n| --- | --- | --- | --- | --- |\n| 0.11.0 | 18.6 s | 60 | 120 | 8255 ms |\n| 0.11.1 | under 0.01 s | 0 | 0 | none measurable |\n\nIdle event-loop stall was 10.8 ms in both cases. On 0.11.1 the first request an instance receives warms both caches, and every request after that reaches the signature check without any outbound network call.\n\n## Credits\n\n@galanko, for reporting the issue and identifying both the missing caching and the blocking call.",
"id": "GHSA-3g9q-v48f-hh9w",
"modified": "2026-09-10T22:44:42Z",
"published": "2026-09-10T22:44:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87011"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.