Executive brief
Open WebUI's identity provider logout handler can be forced to repeatedly fetch and re-validate encryption keys from the OIDC provider without caching, causing the application's single worker process to become unresponsive. An attacker with network access can send a small number of forged logout requests to stall the entire service for several seconds, blocking all chat and API requests until the server recovers.
Technical details
The vulnerability exists in the OIDC back-channel logout handler (`backend/open_webui/utils/oauth.py`, endpoint `POST /oauth/backchannel-logout`). The handler is intentionally unauthenticated because identity providers call it without a browser session. However, before validating the logout token's signature, the code opens a new HTTP session per request to fetch the provider's discovery document and signing keys (JWKS), with no caching between requests. The JWKS client fetch runs as a blocking (synchronous) call directly on the async event loop. An attacker can send requests with invalid tokens (e.g., four-character signatures) to trigger these expensive operations repeatedly. On version 0.11.0, 60 concurrent requests caused an 8.3-second event-loop stall, during which no other requests are answered. The fix (version 0.11.1) caches both the discovery document and signing keys per provider, makes fetches asynchronous, and rejects tokens lacking a `kid` header before any network lookups. Preconditions: `ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true` (not default but recommended in hardening docs) and at least one OIDC provider configured.
Affected products
- Open WebUI Open WebUI 0.9.0 through 0.11.0
Timeline
- 2026-09-04: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Version 0.11.1 released