CVE-2026-87011: Open WebUI unauth DoS

Q: Is CVE-2026-87011 actively exploited?

No confirmed active exploitation of CVE-2026-87011 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87011?

Upgrade to Open WebUI 0.11.1 or later immediately — the fix caches the OIDC discovery document/signing keys and validates the logout token before performing network fetches. If immediate patching isn't possible, disable ENABLE_OAUTH_BACKCHANNEL_LOGOUT until patched, since the vulnerable code path only executes when that flag is set. As a compensating control, place a reverse proxy or WAF rate limit in front of /oauth/backchannel-logout, and monitor for abnormal request volume to that path paired with a spike in outbound calls to your OIDC discovery/JWKS endpoints. Confirm your deployment is single-worker (the advisory notes the stall is worse under single-worker configurations) and consider running multiple workers as defense-in-depth against event-loop blocking bugs generally.

Q: What systems are affected by CVE-2026-87011?

This vulnerability affects the following AI/ML architecture patterns: ml_ui / self-hosted LLM chat platforms, SSO/OIDC-integrated AI portals, single-worker web service deployments.

Q: What is the CVSS score for CVE-2026-87011?

CVE-2026-87011 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.36%.

CISO Take

Open WebUI's OAuth backchannel-logout endpoint fetches the OIDC discovery document and validates signing keys before checking whether the submitted logout token is even valid, and that key lookup blocks the app's single async worker thread. Any unauthenticated attacker can hammer this endpoint with garbage tokens to stall the entire instance and, because each invalid request triggers a fresh uncached network call, simultaneously flood the organization's identity provider with amplified traffic. This only bites when ENABLE_OAUTH_BACKCHANNEL_LOGOUT is set, which narrows exposure, but the attack requires no credentials, no user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), and Open WebUI has 168 other CVEs on record and 3 tracked downstream dependents, indicating a broad and actively-scrutinized deployment base. EPSS sits at the 73rd percentile — not top-tier hot, and there's no known public exploit, KEV listing, or Nuclei template yet, so this is exploitable-but-not-yet-weaponized. Patch to 0.11.1 immediately on any instance with backchannel logout enabled; if you can't patch right away, disable ENABLE_OAUTH_BACKCHANNEL_LOGOUT or front the endpoint with rate limiting, and watch for repeated POST spikes to /oauth/backchannel-logout in access logs alongside outbound calls to your IdP's discovery endpoint.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Moderate-high risk for exposed instances. Exploitability is trivial (no auth, no valid token needed, low attack complexity) and the attack surface is a single unauthenticated network endpoint, but real-world impact is scoped to availability only (CVSS C:N/I:N/A:H) — no data exposure or model manipulation. Actual likelihood of exploitation is tempered by the feature flag gate (ENABLE_OAUTH_BACKCHANNEL_LOGOUT must be enabled) and by the lack of a public PoC, KEV entry, or scanner template. Given Open WebUI's popularity as a self-hosted LLM front-end and its 168-CVE history, this is a straightforward, low-effort DoS an opportunistic attacker or automated scanner could stumble into once instances are fingerprinted as running OAuth-enabled Open WebUI.

How does the attack unfold?

Entry point

Attacker identifies an internet-facing Open WebUI instance running 0.9.0-0.11.0 with ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled.

AML.T0049

Exploitation

Attacker sends repeated unauthenticated POST requests to /oauth/backchannel-logout with invalid logout tokens; each triggers an uncached OIDC discovery fetch and a blocking signing-key lookup before token validation occurs.

Amplification

The blocking key lookup stalls the app's single async worker while also generating repeated outbound network calls to the victim's identity provider.

Impact

The Open WebUI instance becomes unresponsive for all legitimate users, and the identity provider absorbs amplified, attacker-driven traffic.

AML.T0029

Entry point

Attacker identifies an internet-facing Open WebUI instance running 0.9.0-0.11.0 with ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled.

AML.T0049

Exploitation

Attacker sends repeated unauthenticated POST requests to /oauth/backchannel-logout with invalid logout tokens; each triggers an uncached OIDC discovery fetch and a blocking signing-key lookup before token validation occurs.

Amplification

The blocking key lookup stalls the app's single async worker while also generating repeated outbound network calls to the victim's identity provider.

Impact

The Open WebUI instance becomes unresponsive for all legitimate users, and the identity provider absorbs amplified, attacker-driven traffic.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.0, <= 0.11.0	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade to Open WebUI 0.11.1 or later immediately — the fix caches the OIDC discovery document/signing keys and validates the logout token before performing network fetches. If immediate patching isn't possible, disable ENABLE_OAUTH_BACKCHANNEL_LOGOUT until patched, since the vulnerable code path only executes when that flag is set. As a compensating control, place a reverse proxy or WAF rate limit in front of /oauth/backchannel-logout, and monitor for abnormal request volume to that path paired with a spike in outbound calls to your OIDC discovery/JWKS endpoints. Confirm your deployment is single-worker (the advisory notes the stall is worse under single-worker configurations) and consider running multiple workers as defense-in-depth against event-loop blocking bugs generally.

How is it classified?

DoS Framework API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-87011?

Open WebUI's OAuth backchannel-logout endpoint fetches the OIDC discovery document and validates signing keys before checking whether the submitted logout token is even valid, and that key lookup blocks the app's single async worker thread. Any unauthenticated attacker can hammer this endpoint with garbage tokens to stall the entire instance and, because each invalid request triggers a fresh uncached network call, simultaneously flood the organization's identity provider with amplified traffic. This only bites when ENABLE_OAUTH_BACKCHANNEL_LOGOUT is set, which narrows exposure, but the attack requires no credentials, no user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), and Open WebUI has 168 other CVEs on record and 3 tracked downstream dependents, indicating a broad and actively-scrutinized deployment base. EPSS sits at the 73rd percentile — not top-tier hot, and there's no known public exploit, KEV listing, or Nuclei template yet, so this is exploitable-but-not-yet-weaponized. Patch to 0.11.1 immediately on any instance with backchannel logout enabled; if you can't patch right away, disable ENABLE_OAUTH_BACKCHANNEL_LOGOUT or front the endpoint with rate limiting, and watch for repeated POST spikes to /oauth/backchannel-logout in access logs alongside outbound calls to your IdP's discovery endpoint.

Is CVE-2026-87011 actively exploited?

No confirmed active exploitation of CVE-2026-87011 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87011?

Upgrade to Open WebUI 0.11.1 or later immediately — the fix caches the OIDC discovery document/signing keys and validates the logout token before performing network fetches. If immediate patching isn't possible, disable ENABLE_OAUTH_BACKCHANNEL_LOGOUT until patched, since the vulnerable code path only executes when that flag is set. As a compensating control, place a reverse proxy or WAF rate limit in front of /oauth/backchannel-logout, and monitor for abnormal request volume to that path paired with a spike in outbound calls to your OIDC discovery/JWKS endpoints. Confirm your deployment is single-worker (the advisory notes the stall is worse under single-worker configurations) and consider running multiple workers as defense-in-depth against event-loop blocking bugs generally.

What systems are affected by CVE-2026-87011?

This vulnerability affects the following AI/ML architecture patterns: ml_ui / self-hosted LLM chat platforms, SSO/OIDC-integrated AI portals, single-worker web service deployments.

What is the CVSS score for CVE-2026-87011?

CVE-2026-87011 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

ml_ui / self-hosted LLM chat platformsSSO/OIDC-integrated AI portalssingle-worker web service deployments

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.

Exploitation Scenario

An attacker scans for internet-facing Open WebUI deployments (a common self-hosted LLM front-end) and fingerprints one with SSO/OIDC and backchannel logout enabled. Without needing any credentials, they script a loop of POST requests to /oauth/backchannel-logout carrying syntactically-valid-but-unsigned or garbage logout tokens. Each request forces the server to re-fetch the OIDC discovery document and perform a blocking signing-key lookup on the app's single async worker, so a modest request rate is enough to stall the event loop and make the instance unresponsive to legitimate chat users — while simultaneously spamming the victim's identity provider with discovery/JWKS traffic, which can look like a secondary attack or trigger IdP throttling.

Weaknesses (CWE)

CWE-405 Asymmetric Resource Consumption (Amplification) Primary CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-405 Asymmetric Resource Consumption (Amplification) CWE-770 Allocation of Resources Without Limits or Throttling

CWE-405 — Asymmetric Resource Consumption (Amplification): The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

[Architecture and Design] An application must make resources available to a client commensurate with the client's access level.
[Architecture and Design] An application must, at all times, keep track of allocated resources and meter their usage appropriately.

Source: MITRE CWE corpus.