Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- Record
- CVE-2026-54008
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- June 25, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py::_process_picture_url calls validate_url(picture_url) on the initial URL only, then invokes aiohttp.ClientSession.get(picture_url, ...) without allow_redirects=False. aiohttp's default is allow_redirects=True, max_redirects=10; the function does not pass the project's AIOHTTP_CLIENT_ALLOW_REDIRECTS env constant either. An attacker with a valid OAuth IdP identity can therefore submit a public URL that 302-redirects to an internal address and read the internal response body via the attacker's own profile_image_url field. This vulnerability is fixed in 0.9.6.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for artificial intelligence (AI) tools that your organization can host on its own computers, even fully offline. This flaw affects versions before 0.9.6 that let people log in through single sign-on, an outside sign-in service. When Open WebUI fetches a user's profile picture during sign-in, it checks only the first web address and then follows redirects (automatic forwarding to another address). Someone with a valid account at your sign-in service could give a public address that forwards to an internal one. They could then read what your internal systems send back through their own profile picture. This flaw is rated High.
What to do
- The person who installed or runs Open WebUI for your organization should check which version is in use.
- If it is older than
0.9.6, update to0.9.6or a later release, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update will be done.
- If people sign in to Open WebUI through a single sign-on service, treat this update as urgent, because anyone with an account at that service could use this flaw.
Analysis written from the source record as of June 25, 2026 and reviewed before publishing.