https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:25:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45675 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment &#34;Insert with default role first to avoid TOCTOU race&#34;, but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment &#34;Insert with default role first to avoid TOCTOU race&#34;, but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-45675