Open WebUI CVE-2026-87016

Three conditions must hold simultaneously: (1) the Open WebUI instance must use SQLite as its database backend - PostgreSQL deployments are explicitly unaffected by design; (2) OAuth login (get_user_by_oauth_sub) or SCIM provisioning (get_user_by_scim_external_id) must be enabled and accessible to the attacker; (3) the attacker must be able to obtain or craft an OAuth/SCIM identity whose sub or external_id claim contains SQL LIKE wildcard characters (% or _) that match the stored sub of a target account via substring matching. No prior authentication to Open WebUI is required - the attack occurs during the initial OAuth callback. The primary limiting factor is the need to control a specially-formed sub claim from a cooperating or permissive OAuth identity provider.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately characterises the vulnerability: the OAuth login endpoint is network-reachable with no prior authentication, but exploitation complexity is high because the attacker must obtain or craft an OAuth identity whose sub claim contains wildcard characters that match, via LIKE, a stored administrator sub - a non-trivial condition dependent on the target administrator's stored identity string and on the OAuth provider permitting wildcard characters in issued sub claims. Real-world reach is further bounded to SQLite deployments; PostgreSQL-backed instances are entirely unaffected. Despite these constraints, SQLite is the common default for self-hosted Open WebUI, and even a mid-sized municipal IT team in gliwice running Open WebUI on a single-server SQLite deployment for internal AI tooling should treat this as an urgent upgrade given the full account-takeover consequence and the absence of any authentication gate before the vulnerable lookup. No public exploit code exists and no CISA KEV listing has been issued, keeping the risk elevated but not confirmed-actively-exploited at time of analysis.

An attacker registers an account with any OAuth provider that issues a sub claim containing % or _ - for example % alone or %admin% - then initiates an OAuth login flow to a SQLite-backed Open WebUI instance. The backend executes a LIKE query that matches the sub against stored administrator identity strings as a substring pattern; if the wildcard resolves to a stored admin sub, the server issues the attacker a valid administrator session. No public exploit code has been identified, but the primitive is straightforward to construct given knowledge of the ORM behavior and any information about the target admin's stored sub string.