Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45675
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- July 15, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment "Insert with default role first to avoid TOCTOU race", but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for AI models that your organization runs on its own computers. This flaw affects versions before 0.9.0 when people sign in through a company directory login (LDAP) or through an outside sign-in service (OAuth). When the first account is set up through either of these sign-in methods, the product hands out the administrator role in a way that leaves a timing gap. If several sign-ins arrive at the same moment, more than one account can end up as an administrator, so an attacker could gain administrator rights. This flaw is rated High.
What to do
- Decide who acts: the person who installed or runs Open WebUI for your organization, or the IT provider or vendor who manages it for you.
- If you run it yourselves, update Open WebUI to version
0.9.0or later. This version fixes this flaw in the company directory and outside sign-in methods. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update to
0.9.0will be done. - Check the vendor advisory linked on this page for full details on the fix.
Analysis written from the source record as of July 15, 2026 and reviewed before publishing.