CVE-2026-45675

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-45675
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, he LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment "Insert with default role first to avoid TOCTOU race", but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec Patch
https://github.com/open-webui/open-webui/pull/23626 Issue Tracking
https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*
History

19 May 2026, 14:16

Type Values Removed Values Added
References () https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 - Exploit, Mitigation, Vendor Advisory () https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 - Exploit, Mitigation, Vendor Advisory

19 May 2026, 01:37

Type Values Removed Values Added
References () https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec - () https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec - Patch
References () https://github.com/open-webui/open-webui/pull/23626 - () https://github.com/open-webui/open-webui/pull/23626 - Issue Tracking
References () https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 - () https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 - Exploit, Mitigation, Vendor Advisory
First Time Openwebui
Openwebui open Webui
CPE cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

15 May 2026, 21:16

Type Values Removed Values Added
References () https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 - () https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 -

15 May 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-15 20:16

Updated : 2026-05-19 14:16

NVD link : CVE-2026-45675

Mitre link : CVE-2026-45675

CVE.ORG link : CVE-2026-45675

JSON object : View

Products Affected

openwebui

  • open_webui
CWE
CWE-269

Improper Privilege Management

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')