{"schemaVersion":3,"id":"CVE-2026-87011","aliases":["GHSA-3g9q-v48f-hh9w","PYSEC-2026-4117"],"status":"published","duplicateOf":null,"title":null,"description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.","dates":{"published":"2026-09-09T20:54:26.207Z","modified":"2026-09-14T13:42:35.435Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00644,"percentile":0.50171,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.28600000000000003,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00358},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00339,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00339,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00644,"percentile":0.50171}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00358,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00644,"percentile":0.50171}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_OPEN-WEBUI_OPEN-WEBUI","name":"Open Webui","source":"github","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-8gh5-qqh8-hq3x","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-405","name":"Asymmetric Resource Consumption (Amplification)","description":"The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is \"asymmetric.\"","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/405.html"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"open-webui","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.9.0, < 0.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.9.0, < 0.11.1","eol":null,"hubHref":"/vendor/open-webui/open-webui"},{"vendor":"openwebui","product":"open_webui","name":"open webui","label":"open_webui","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.9.0, < 0.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.9.0, < 0.11.1","eol":null,"hubHref":"/vendor/openwebui/open_webui"},{"vendor":"PyPI","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/open-webui","purlType":"pypi","versions":[{"text":"≥ 0.9.0, < 0.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.9.0, < 0.11.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w","label":"github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c","label":"github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c","hostname":"github.com","tags":["X Refsource MISC","WEB","Patch"]},{"url":"https://github.com/open-webui/open-webui/releases/tag/v0.11.1","label":"github.com/open-webui/open-webui/releases/tag/v0.11.1","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87011","label":"nvd.nist.gov/vuln/detail/CVE-2026-87011","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/open-webui/open-webui","label":"github.com/open-webui/open-webui","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://pypi.org/project/open-webui","label":"pypi.org/project/open-webui","hostname":"pypi.org","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-3g9q-v48f-hh9w","label":"github.com/advisories/GHSA-3g9q-v48f-hh9w","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-09T20:54:26.207Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-14T13:42:35.435Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T12:33:54.780Z","stale":false,"partial":false}}