TOCTOU Vulnerability in Open WebUI LDAP and OAuth Authentication

CVE-2026-45675

What is CVE-2026-45675?

The Open WebUI, a self-hosted artificial intelligence platform, contains a vulnerability in its LDAP and OAuth authentication mechanisms. Specifically, prior to version 0.9.0, the system utilized a vulnerable TOCTOU (Time-of-Check-Time-of-Use) pattern when assigning first-user admin roles. Although the regular signup process was patched to mitigate this issue, the LDAP and OAuth authentication flows remained unaddressed, leaving a critical gap that could potentially allow unauthorized role assignments.

References