CVE-2026-45675
HIGHOpen WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
Title source: cnaDescription
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, he LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment "Insert with default role first to avoid TOCTOU race", but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3
X_Refsource_Misc x_refsource_misc
https://github.com/open-webui/open-webui/pull/23626
X_Refsource_Misc x_refsource_misc
https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec
Scores
CVSS v3
8.1
EPSS
0.0011
EPSS Percentile
29.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-269
CWE-362
Status
published
Products (3)
open-webui/open-webui
< 0.9.0
openwebui/open_webui
< 0.9.0
pypi/open-webui
0 - 0.9.0PyPI
Published
May 15, 2026
Tracked Since
May 16, 2026