---
id: CVE-2026-87016
title: >-
  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI
  platform
summary: >-
  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI
  platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and
  get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON
  contains matching that…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-155
  - CWE-287
vendor: openwebui
product: open_webui
affected:
  - 'open_webui >= 0.6.41, < 0.11.1'
patched:
  - open_webui 0.11.1
published: '2026-09-09'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T15:29:13.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87016'
references:
  - url: >-
      https://github.com/open-webui/open-webui/commit/73c1f5806aeb6345dad5de8f5aa26d1f3d0bef80
    label: security-advisories@github.com
  - url: 'https://github.com/open-webui/open-webui/pull/28624'
    label: security-advisories@github.com
  - url: 'https://github.com/open-webui/open-webui/releases/tag/v0.11.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0035
epssPercentile: 0.28584
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T13:43:02.743594Z'
ingestedAt: '2026-09-14T15:23:07.420Z'
---

## Overview

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.

## Affected

- `open_webui >= 0.6.41, < 0.11.1`

## Remediation

Upgrade past the affected range:

- `open_webui 0.11.1`