CVE-2026-87016 in Open WebUI
Summary
by MITRE • 09/09/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within Open WebUI versions ranging from 0.6.41 to 0.11.1 represents a critical authentication bypass mechanism rooted in improper input validation and database query construction. The core technical flaw resides in the backend implementation of user lookup functions, specifically get_user_by_oauth_sub and get_user_by_scim_external_id located within the users.py module. These functions are responsible for mapping external identity provider subjects to local application accounts during the login process. When operating against a SQLite database engine, these functions utilized JSON contains matching logic that was inadvertently compiled into SQL LIKE substring queries. This architectural decision introduced a significant security gap because the SQL LIKE operator interprets specific characters as wildcards rather than literal values unless explicitly escaped.
The operational impact of this flaw is severe, allowing for account takeover and privilege escalation through crafted OAuth or SCIM external identifiers. Specifically, an attacker can exploit the wildcard behavior by including percent signs (%) or underscores (_) within their OAuth subject claim during authentication requests. In SQL LIKE patterns, a percent sign matches any sequence of zero or more characters, while an underscore matches exactly one character. By injecting these wildcards into the identity provider's response, an attacker can manipulate the database query to match against unintended records in the user table. For instance, if an administrator account exists with a username or ID that partially overlaps with the pattern created by the wildcard injection, the system may incorrectly resolve the login attempt to that privileged account rather than creating a new unprivileged one or failing authentication.
This vulnerability effectively bypasses standard access controls because it allows an attacker to assume the identity of any user whose stored identifier matches the crafted SQL pattern. The most dangerous scenario involves resolving to an administrator account, which grants the attacker full control over the Open WebUI instance. This could lead to unauthorized access to sensitive data, manipulation of AI models and configurations, or further exploitation within the host environment if additional vulnerabilities exist in the platform's integration points. It is important to note that this specific vector only affects deployments using SQLite as their backend database engine; PostgreSQL deployments were not impacted due to differences in how JSON containment queries are handled natively by that database system without falling back to substring matching with wildcards.
To mitigate this risk, organizations running Open WebUI must upgrade immediately to version 0.11.1 or later, where the issue has been resolved through proper input sanitization and corrected query construction methods that prevent wildcard interpretation in identity lookups. For environments unable to patch immediately due to operational constraints, implementing a web application firewall rule to block OAuth tokens containing percent signs or underscores during authentication flows can provide temporary relief, though this is not a robust long-term solution. Additionally, reviewing the database schema for any existing accounts with predictable identifiers that might be susceptible to wildcard matching can help assess exposure levels. Adhering to industry standards such as CWE-94 regarding improper control of generation of code or SQL commands and aligning with MITRE ATT&CK techniques related to authentication bypass is essential for maintaining a secure posture against similar identity-based attacks in future development cycles.