Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T21:17:05.847Z",
  "pubdate": "2026-09-09T21:17:05.847Z",
  "executiveSummary": "Open WebUI is susceptible to a Denial of Service (DoS) vulnerability within its OIDC backchannel logout implementation. The flaw exists in the unauthenticated POST /oauth/backchannel-logout endpoint, where improper handling of OIDC discovery and cryptographic signing keys results in resource exhaustion.\nWhen ENABLE_OAUTH_BACKCHANNEL_LOGOUT is active, the application performs uncached, synchronous network fetches for OIDC metadata every time an incoming request is processed. This behavior is exploitable by unauthenticated remote attackers who can flood the server with invalid logout tokens. The vulnerability leads to the exhaustion of the single-worker instance's async event loop, effectively halting service for legitimate users.\nThe risk implication is significant as it allows an attacker to degrade or entirely disable the self-hosted AI platform's availability without requiring any authentication or elevated privileges. Affected versions include Open WebUI from 0.9.0 up to, but not including, 0.11.1.",
  "technicalDetails": "The vulnerability resides in backend/open_webui/utils/oauth.py within the backchannel-logout handler. The root cause is twofold: the lack of caching for OIDC discovery documents and public signing keys, and the use of blocking synchronous network operations within an asynchronous execution context.\nWhen a POST request is sent to the /oauth/backchannel-logout endpoint, the application logic initiates a series of network fetches to the configured identity provider (IdP) to retrieve the OIDC discovery document and the JWKS (JSON Web Key Set) for token validation. Because these network operations are implemented synchronously and without local caching, each request forces the worker process to wait for the complete round-trip time of the external IdP communication.\nThe attack flow proceeds as follows: An unauthenticated attacker sends a high volume of POST requests to /oauth/backchannel-logout. Each request carries an invalid logout token, forcing the application to perform expensive metadata retrieval and cryptographic lookup operations for every individual request. Because the application utilizes a single-worker instance model, the blocking nature of the signing-key lookup stalls the entire async event loop. Consequently, all other application tasks, including legitimate user requests, are queued or dropped.\nBeyond the impact on the local instance, the vulnerability creates an amplification effect against the configured Identity Provider. By triggering constant, uncached lookups, the attacker can inadvertently perform a distributed-like attack on the IdP's metadata or JWKS endpoints. The lack of validation logic before initiating these heavy operations allows the attacker to force the server into a state of resource starvation with minimal effort. The vulnerability is present in versions 0.9.0 through 0.11.0, and it is explicitly triggered by the ENABLE_OAUTH_BACKCHANNEL_LOGOUT environment variable being set to true."
}