Executive brief
Open WebUI, a popular interface for large language models, is vulnerable to a security flaw where it can be forced to make unauthorized requests to internal systems. By providing a malicious profile picture link during the login or signup process, an attacker can trick the server into accessing sensitive internal data, such as cloud credentials or private network services. This could lead to the exposure of confidential infrastructure information or unauthorized access to internal company resources.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `_process_picture_url` function within `backend/open_webui/utils/oauth.py`. The application fails to validate the URL provided in the OAuth `picture` claim before fetching it using `aiohttp`. An attacker can provide a URL pointing to internal resources (e.g., AWS metadata endpoints at 169.254.169.254 or local services like Redis). Because the server base64-encodes the full response and stores it as the user's profile image, the attacker can then read the exfiltrated data via the user profile API. This vulnerability is exploitable when `ENABLE_OAUTH_SIGNUP` or `OAUTH_UPDATE_PICTURE_ON_LOGIN` is enabled. The issue is fixed in version 0.9.0 by implementing URL validation.
Affected products
- open-webui open-webui <= 0.8.12
Timeline
- 2026-05-09: disclosed: Initial disclosure on GitHub Advisories
- 2026-05-14: advisory: Updated advisory published
- 2026-05-14: patched: Fixed in version 0.9.0