EUVD-2026-75176
GHSA-wpmr-8h3q-fwj7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OAuth endpoint is network-reachable with no prior auth, but AC:H reflects the non-trivial requirement to craft a wildcard sub that matches a stored identity on a SQLite-only deployment.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
9DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.
AnalysisAI
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated remote attackers to hijack arbitrary stored user accounts, including administrator accounts, by presenting an OAuth subject claim containing SQL LIKE wildcard characters. SQLAlchemy's JSON.contains() on SQLite compiles to a substring LIKE match rather than an exact equality check, so a crafted sub claim such as %admin% can resolve to a different stored identity and cause the server to issue the attacker a valid session token for that identity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must hold simultaneously: (1) the Open WebUI instance must use SQLite as its database backend - PostgreSQL deployments are explicitly unaffected by design; (2) OAuth login (`get_user_by_oauth_sub`) or SCIM provisioning (`get_user_by_scim_external_id`) must be enabled and accessible to the attacker; (3) the attacker must be able to obtain or craft an OAuth/SCIM identity whose `sub` or `external_id` claim contains SQL LIKE wildcard characters (`%` or `_`) that match the stored sub of a target account via substring matching. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately characterises the vulnerability: the OAuth login endpoint is network-reachable with no prior authentication, but exploitation complexity is high because the attacker must obtain or craft an OAuth identity whose `sub` claim contains wildcard characters that match, via LIKE, a stored administrator sub - a non-trivial condition dependent on the target administrator's stored identity string and on the OAuth provider permitting wildcard characters in issued sub claims. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Open WebUI version 0.11.1, which fixes the root cause by replacing `JSON.contains()` with subscript-based exact-string equality in both `get_user_by_oauth_sub` and `get_user_by_scim_external_id`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Open WebUI deployments to identify instances running versions 0.6.41-0.10.x with SQLite backends, particularly those accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u
Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow)
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases wh
SQLite's zipfile extension contains a bug in the zipfileInflate function that leaks heap memory contents when processing
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today