← Vulnerability feed

Vulnerability record · CVE-2026-87011 · published 9 September 2026

CVE-2026-87011: Openwebui open webui allocation without limits vulnerability

Openwebui · Open Webui

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.

7.5 CVSS 3.1 High EPSS 0.64% · top 51.2% CWE-405 · CWE-405CWE-770 · Allocation without limits
7.5CVSS 3.1 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
15 Sep 2026Last modified by NVD

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c Patch
https://github.com/open-webui/open-webui/releases/tag/v0.11.1 Release Notes
https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w ExploitVendor Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w ExploitVendor Advisory

Track CVE-2026-87011 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-44566Openwebui open webui path traversal vulnerabilityOpen WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, when attaching files to a promp,…EPSS 0.46%9.1CVE-2026-44551Openwebui open webui improper authentication vulnerabilityOpen WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint d…EPSS 1.6%9.0CVE-2026-56400Openwebui open webui insufficient session expiration vulnerabilityopen-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated …EPSS 0.52%9.0CVE-2026-59214Openwebui open webui cross-site scripting vulnerabilityOpen WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodid…EPSS 0.42%9.0CVE-2026-59216Openwebui open webui code injection vulnerabilityOpen WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and ex…EPSS 0.45%9.0CVE-2024-8017Openwebui open webui cross-site scripting vulnerabilityAn XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vuln…EPSS 0.60%8.9CVE-2024-7044Openwebui open webui cross-site scripting vulnerabilityA Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker ca…EPSS 0.52%8.8CVE-2026-70482Openwebui open webui improper authentication vulnerabilityOpen WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True,…EPSS 0.57%

Source: NIST National Vulnerability Database (record CVE-2026-87011), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.