Unauthenticated Token Handling Flaw in Open WebUI by Open WebUI

CVE-2026-87011

What is CVE-2026-87011?

Open WebUI versions 0.9.0 through 0.11.0 are susceptible to a vulnerability in the unauthenticated POST /oauth/backchannel-logout handler. The issue arises when the backend attempts to fetch the OIDC discovery document and signing keys before validating a logout token. This design flaw results in repeated network requests for each user interaction, causing extended blocking of the async event loop due to the signing-key lookup. This leads to potential stalling of the single-worker instance and can amplify traffic directed to the identity provider when the ENABLE_OAUTH_BACKCHANNEL_LOGOUT option is activated. The vulnerability has been rectified in version 0.11.1.

References