CyberRota Analysis
AI-GeneratedThe Open WebUI platform versions 0.9.0 to 0.11.1 are vulnerable due to an unauthenticated POST handler that improperly processes logout tokens, potentially leading to denial of service by stalling the server and amplifying traffic to the identity provider. Organizations using affected versions should prioritize upgrading to version 0.11.1 to mitigate the risk of service disruption and unauthorized access. This vulnerability is particularly critical for deployments that have enabled the OAuth backchannel logout feature.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.