CVE-2026-87011

High

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.

SeverityHigh

CVSS7.5

Exploit probability51. percentile0.6%

ProductOpenwebui Open Webui

PublishedSep 9, 2026

First seenSep 9, 2026

Weakness typeCWE-405CWE-405 CWE-770Allocation of resources without limits

How to fix

Update

openwebui open_webui0.11.1 or later
open-webui0.11.1 or later

Affected products

Product	Affected versions	Fixed in
openwebui open_webui	0.9.0 ≤ v < 0.11.1	0.11.1
open-webuiPyPI	0.9.0 ≤ v < 0.11.1	0.11.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.