CVE-2026-45675: Open WebUI LDAP And OAuth First-User Race Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h3ww-q6xx-w7x3",
  "modified" : "2026-07-15T21:50:58Z",
  "published" : "2026-05-14T20:28:46Z",
  "aliases" : [ "CVE-2026-45675" ],
  "summary" : "Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts",
  "details" : "## Summary\n\nThe LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (`signup_handler` in auths.py, line 663) was explicitly patched to prevent this race with the comment *\"Insert with default role first to avoid TOCTOU race\"*, but the LDAP and OAuth code paths were never updated with the same fix.\n\n## Vulnerable Code\n\n### LDAP (auths.py, lines 479-490)\n```python\n# Line 482 - CHECK: is the user table empty?\nrole = 'admin' if not Users.has_users(db=db) else request.app.state.config.DEFAULT_USER_ROLE\n\n# Lines 484-490 - USE: create user with the role determined above\nuser = Auths.insert_new_auth(\n    email=email,\n    password=str(uuid.uuid4()),\n    name=cn,\n    role=role,   # <-- role was determined BEFORE insert, race window exists\n    db=db,\n)\n```\n\n### OAuth (oauth.py, lines 1103-1112, 1566-1574)\n```python\n# Line 1104 - CHECK: count users\ndef get_user_role(self, user, user_data):\n    user_count = Users.get_num_users()\n    if not user and user_count == 0:\n        return 'admin'    # Line 1112\n\n# Lines 1566-1574 - USE: create user with pre-determined role\nuser = Auths.insert_new_auth(\n    ...\n    role=self.get_user_role(None, user_data),  # Line 1571\n    ...\n)\n```\n\nBoth paths determine the role BEFORE inserting the user, creating a race window where multiple concurrent requests on a fresh instance can all observe an empty database and all receive the `admin` role.\n\n## Comparison with Patched Signup\n\nThe `signup_handler` (auths.py, line 663) was explicitly fixed:\n```python\n# Insert with default role first to avoid TOCTOU race\nuser = Auths.insert_new_auth(..., role=DEFAULT_USER_ROLE, ...)\n# Then check if this is the only user and upgrade\nif Users.get_num_users() == 1:\n    Users.update_user_role_by_id(user.id, 'admin')\n```\n\nThe LDAP and OAuth paths did NOT receive this fix.\n\n## Exploitation\n\n1. Deploy Open WebUI with LDAP or OAuth enabled on a fresh instance (no existing users)\n2. Send multiple concurrent authentication requests from different users\n3. Multiple requests pass the `has_users()` / `get_num_users() == 0` check simultaneously\n4. All concurrent users become administrators\n\n`DATABASE_ENABLE_SESSION_SHARING` defaults to `False` (env.py:387), so each call uses its own database session, widening the race window.\n\n## Impact\n\nAny LDAP/OAuth user who times their first login concurrently with the legitimate first admin can escalate to full admin privileges, gaining access to all user data, system configuration, API keys, and connected LLM backends.\n\n## Suggested Fix\n\nApply the same insert-then-check pattern used in `signup_handler`: insert the user with `DEFAULT_USER_ROLE` first, then atomically check if this is the only user and upgrade to admin only if so.\n\n## Resolution\n\nFixed in PR [#23626](https://github.com/open-webui/open-webui/pull/23626) (commit [96a0b3239](https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec)), first released in **v0.9.0** (Apr 2026). Both LDAP (`routers/auths.py`) and OAuth (`utils/oauth.py`) registration paths now use the same insert-first-check-after pattern that `signup_handler` already had:\n\n1. Insert the new user with `DEFAULT_USER_ROLE` unconditionally — no pre-insert role decision based on user count.\n2. After the insert commits, atomically call `Users.get_num_users() == 1` to check whether this is the sole user.\n3. Only the sole user gets promoted to `admin` via `Users.update_user_role_by_id`.\n\n`OAuthManager.get_user_role` was also updated to return `DEFAULT_USER_ROLE` (not `admin`) for first-user bootstrap; admin promotion is deferred to the post-insert check above. With this ordering, two concurrent first-user registrations that both observe an empty table can both insert, but only one will see `get_num_users() == 1` afterward — the other will see `== 2` and not be promoted.\n\nUsers on `>= 0.9.0` are not affected.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.9.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.8.12"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45675"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/pull/23626"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/releases/tag/v0.9.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2730.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269", "CWE-362" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-14T20:28:46Z",
    "nvd_published_at" : "2026-05-15T20:16:49Z"
  }
}