Account Enumeration in Open WebUI AI Platform

CVE-2026-59218

What is CVE-2026-59218?

The Open WebUI AI platform, prior to version 0.10.0, contained a vulnerability in the /api/v1/auths/signin endpoint. The implementation allowed for user account enumeration due to its handling of email lookups and bcrypt password verification. Specifically, the system was able to return information about existing user credentials while processing credential requests at varying speeds. This situation made it possible for an attacker to determine whether an email address was registered in the system, facilitating unauthorized user account enumeration. The issue was addressed in version 0.10.0, which implemented more robust measures to prevent unauthorized access attempts.

References