Open WebUI sign-in binds to another user via wildcard characters in the OAuth subject claim on SQLite
OSV · 1 source
What's on the official record
The OSV advisory GHSA-wpmr-8h3q-fwj7 reports a HIGH severity vulnerability in the PyPI package open-webui, in the ai_app layer, aliased as CVE-2026-87016. On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the match returns. The advisory names CWE-155 and CWE-287 and states the issue is fixed in 0.11.1. The advisory is dated 10 September 2026.
Assessment
For a platform or AI-stack owner, the record lets you check whether any open-webui deployment you run uses SQLite as its backing store and whether it is below version 0.11.1. The advisory states the sign-in binding flaw is specific to SQLite deployments, so the record supports confirming the database backend and the running version before deciding to patch or pull the affected version. The fixed version named in the advisory is 0.11.1.
For a deal team, the record lets you scope diligence on any target that ships or operates open-webui by asking which version is deployed and which database backend it uses. The advisory names a fixed version, 0.11.1, which gives you a concrete line to check against in a technical review. The record does not state any loss, victim, or attacker, so it supports a version-and-backend check rather than a claim about exposure.
What would change this call
A statement from the advisory or the maintainer that the substring match also affects non-SQLite backends would widen the check beyond SQLite deployments. A revised advisory that names a different or additional fixed version would change the version line a reader checks against.
What to check next
| Check | Why |
|---|---|
| Confirm the open-webui version in any deployment | The advisory names 0.11.1 as the fixed version |
| Confirm the database backend is SQLite | The advisory states the flaw is specific to SQLite deployments |
| Watch for a revised advisory or additional fixed versions | A change to the fixed version would alter the check |
Confidence
Filed 23 October 2026 from the record dated 10 September 2026.
Sources
[1] Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite — https://github.com/advisories/GHSA-wpmr-8h3q-fwj7