{"items":[{"id":"NVI-00014000","kind":"vulnerability","title":"Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3g9q-v48f-hh9w","CVE-2026-87011"],"plain_summary":"GitHub lists this reviewed advisory for open-webui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2fa4cea1f68824882bad160e55a0d95a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-10T22:45:10.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2fa4cea1f68824882bad160e55a0d95a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fa4cea1f68824882bad160e55a0d95a","url":"https://github.com/advisories/GHSA-3g9q-v48f-hh9w","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3g9q-v48f-hh9w","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:05.264Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fa4cea1f68824882bad160e55a0d95a"],"technology":"open-webui","known_exclusions":[],"conditions_summary":"## Summary\n\nThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network, and repeated both fetches on every request because nothing was cached. The signing-key fetch also ran as a blocking call inside the async event loop. A small number of requests carrying a worthless token was therefore enough to make the whole instance stop answering.\n\n## Preconditions\n\n- `ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true`. The default is `False`, so a stock deployment is not affected. This setting is recommended in the Open WebUI hardening documentation, which is why the issue is treated as in scope.\n- At least one OIDC provider configured (`OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`, `OPENID_PROVIDER_URL`).\n- No account, credential, session or secret identifier is required. The attacker needs network access to the instance and the configured issuer string, which is published in the provider's own discovery document.\n\n## Impact\n\nAgainst 0.11.0, with the identity provider answering in","public_affected_ranges":[">= 0.9.0, <= 0.11.0"]}],"null_published_at":"2026-11-02T10:00:37.196Z","source_updated_at":"2026-09-10T22:45:10.000Z","source_disclosed_at":"2026-09-10T22:44:42.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:05.264Z"}],"next_cursor":null,"snapshot_revision":"42594"}