CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments are affected?
Only Open WebUI deployments using SQLite are affected. PostgreSQL deployments are not affected; the vulnerable versions are 0.6.41 through versions before 0.11.1.
What does an attacker need to exploit this issue?
An attacker needs to authenticate through an OAuth flow with a subject claim containing percent or underscore wildcard characters. No existing Open WebUI privileges or user interaction are required, but the matching behavior must resolve the supplied subject to another stored identity.
What is the likely impact if exploitation succeeds?
The wildcard subject may match a different stored identity, potentially including an administrator account. Open WebUI could then issue the attacker a session for that account, resulting in compromise of confidentiality, integrity, and availability.
What should teams do if they cannot immediately upgrade?
The provided information identifies version 0.11.1 as the fix and states that PostgreSQL deployments are not affected. No other mitigation is specified.