Quick answers
- Is CVE-2024-12534 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-12534 being exploited in the wild.
- How severe is CVE-2024-12534?
- Low severity, with a CVSS score of 3, published 7 July 2026.
- Which products and versions are affected?
- open-webui (npm) SEMVER:introduced=0,last_affected=0.3.32; open-webui (PyPI) ECOSYSTEM:introduced=0,last_affected=0.3.32.
- Is there a fix for CVE-2024-12534?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-12534 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2024-12534?
- Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400) flaw in the authentication endpoint. The sign-in process does not enforce character length limits on email and password fields, allowing attackers to submit arbitrarily large strings. When processed, these oversized payloads exhaust server resources and trigger a denial-of-service condition. The attack is network-reachable and requires no authentication or user interaction. The vulnerable code is located in src/lib/apis/auths/index.ts (lines 113-142). Versions up to and including v0.3.32 are affected across both PyPI and npm distributions.
Affected products
- Open WebUI Open WebUI 0.1.124 through 0.3.32
Identifiers
- CVE-2024-12534
- GHSA-g3mx-83mp-3rwc
- PYSEC-2026-1733
Timeline
- 2025-03-20: disclosed: Vulnerability published in GitHub Advisory Database and NVD
- 2025-03-21: other: GitHub security team review completed