CVE-2026-87016 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
Attackers can impersonate other users, including administrators, by exploiting wildcard characters in OAuth subject claims on SQLite deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87016?
CVE-2026-87016 is a high-severity authentication bypass vulnerability in Openwebui Open Webui, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.
Which versions are affected by CVE-2026-87016?
3 open source packages ship an affected version, including open-webui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
open-webui PyPI | From 0.6.41 | 0.11.1 |
open-webui PyPI | From 0.6.41 | 0.11.1 |
open-webui PyPI | From 0.6.41 | 0.11.1 |
Products include Openwebui Open Webui.
How do I fix CVE-2026-87016?
Upgrade open-webui to 0.11.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-87016 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87016 exists.
Other vulnerabilities in Openwebui Open Webui
- CVE-2026-44551 Open WebUI: LDAP Empty Password Authentication Bypass
- CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
- CVE-2024-8017 Cross-site Scripting (XSS) in open-webui/open-webui
- CVE-2026-45672 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
- CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Sources
Also known as GHSA-wpmr-8h3q-fwj7, PYSEC-2026-4128.