Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-87016
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 9, 2026
- Source last modified
- September 15, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted chat interface for using AI language models. This flaw affects versions 0.6.41 up to, but not including, 0.11.1, and only setups that store their data in an SQLite database. Setups using a PostgreSQL database are not affected. The problem is in the part that matches people to their accounts when they sign in through an outside single sign-on service or are synced from a user directory. A specially crafted sign-in identity could be matched to a different account, possibly an administrator, and give the attacker that account's session. This flaw is rated High.
What to do
- The person who installed or runs Open WebUI for your organization should check which version is in use and whether it stores its data in SQLite or PostgreSQL.
- If you run a version from 0.6.41 to before 0.11.1 with SQLite, update to version
0.11.1, which fixes this flaw. - If your setup uses a PostgreSQL database, this flaw does not affect it.
- If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 15, 2026 and reviewed before publishing.