Open WebUI: Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-45338
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in _process_picture_url() in backend/open_webui/utils/oauth.py (line ~1338). The function fetches arbitrary URLs from OAuth picture claims without applying validate_url(), allowing an attacker to force the server to make HTTP requests to internal resources and exfiltrate the full response. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for artificial intelligence (AI) models that your organization runs on its own server. It is designed to work entirely offline. This flaw affects versions before 0.9.0. The problem is in the part of the single sign-on login feature that fetches a user's profile picture. It does not check which web address it is asked to fetch. An attacker can make your server send web requests to systems inside your network and then read the full replies, which could expose private information. This flaw is rated High.
What to do
- If someone in your organization installed or runs Open WebUI, ask that person to check which version is in use.
- If the version is earlier than
0.9.0, have them update to0.9.0or later as soon as possible. This version fixes the flaw, and no workaround is named for it. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.