CVE-2026-54008: high-severity vulnerability in open-webui
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py::_process_picture_url calls validate_url(picture_url) on the initial URL only, then invokes aiohttp.ClientSession.get(picture_url, ...) without allow_redirects=False. aiohttp's default is allow_redirects=True, max_redirects=10; the function does not pass the project's AIOHTTP_CLIENT_ALLOW_REDIRECTS env constant either. An attacker with a valid OAuth IdP identity can therefore submit a public URL that 302-redirects to an internal address and read the internal response body via the attacker's own profile_image_url field. This vulnerability is fixed in 0.9.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected products
open-webui · open-webuiRelated CVEs — open-webui
In the same product, most dangerous first.
CVE-2025-64496HIGHOpen WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsEPSS 7.8%CVE-2025-65958HIGHOpen WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/webEPSS 4.4%CVE-2026-44551CRITICALOpen WebUI: LDAP Empty Password Authentication BypassEPSS 1.6%CVE-2026-45397MEDIUMOpen WebUI: Unauthenticated RAG Configuration DisclosureEPSS 0.8%CVE-2026-45395HIGHOpen WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code ExecutionEPSS 0.7%CVE-2026-87011HIGHOpen WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutEPSS 0.6%