Executive brief
Open WebUI is an interface for interacting with large language models. A vulnerability in its login system allowed unauthorized individuals to determine if a specific email address has an account by measuring how long the server takes to respond. This information can be used to target specific users for password-guessing attacks, especially since multi-factor authentication is not enabled by default.
Technical details
The `/api/v1/auths/signin` endpoint is vulnerable to an observable timing discrepancy (CWE-208). The backend only performs a computationally expensive bcrypt password hash comparison if the provided email address exists in the database. If the email is not found, the application returns an error immediately. This creates a measurable difference in response times (~180ms for valid accounts vs ~5ms for invalid ones), allowing unauthenticated attackers to enumerate registered users via the network. The issue is mitigated in version 0.10.0 by ensuring a constant-time comparison is performed against a placeholder hash even when a user is not found.
Affected products
- Open WebUI open-webui < 0.10.0
Timeline
- 2026-06-29: disclosed
- 2026-07-09: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory published/updated