Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.
The Pydantic `LdapForm` model accepts the `password` field as a string (`str`) without any minimum length restriction, allowing an empty string to pass validation. Subsequently, calling `Connection.bind()` on vulnerable LDAP servers succeeds when performing a Simple Bind with an empty password (a mechanism known as 'unauthenticated bind'). The application treats such binding as valid authentication and issues a full session token for the specified user.
An attacker without any credentials can obtain a full session as any user configured in LDAP, leading to complete compromise of confidentiality and integrity of data in the Open WebUI platform.
Open WebUI should be updated to version 0.9.0 or newer, in which the vulnerability has been fixed. Additionally, it is recommended to disable 'unauthenticated bind' support on the LDAP server as an additional layer of protection.
Open WebUI versions prior to 0.9.0 with LDAP integration enabled and a vulnerable LDAP server supporting 'unauthenticated bind'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpenwebui Open Webui
APPOpenwebui< 0.9.0
Related vulnerabilities
open-webui: RCE przez błędną konfigurację CORS i brak walidacji sesji
XSS w Open WebUI — kradzież sesji i eskalacja uprawnień do admina
Open WebUI: stored XSS w przepływie OAuth poprzez SVG jako data URI
Stored XSS w Open WebUI umożliwia nieautoryzowany dostęp do endpointów admina
Open WebUI: nieautoryzowane wykonanie kodu w cudzej sesji przez Socket.IO