CVE-2026-87011

Executive Summary

CVE-2026-87011 is an unauthenticated denial-of-service vulnerability in Open WebUI, a self-hosted AI platform, affecting versions 0.9.0 through 0.11.0. The vulnerable POST /oauth/backchannel-logout handler fetches OIDC discovery documents and signing keys before validating submitted logout tokens, and each request performs uncached network fetches while the signing-key lookup blocks the async event loop. Because the endpoint is unauthenticated and the fetch loop is synchronous within an asynchronous framework, a single attacker can stall a single-worker instance and simultaneously amplify traffic toward the configured identity provider, earning the maximum availability-only impact score (CVSS 7.5, A:H). No public proof-of-concept, Nuclei template, or exploit code is currently available, and the vendor fix is exclusive to version 0.11.1.

Technical Analysis

The vulnerability resides in the OAuth backchannel logout flow of Open WebUI. OpenID Connect (OIDC) backchannel logout is a standards-defined mechanism in which an identity provider (IdP) notifies a relying party that a user session should be terminated. The relying party exposes an endpoint — in this case POST /oauth/backchannel-logout — that accepts a logout token, typically a signed JWT, and validates it against the IdP's published signing keys before processing the logout.

Per the NVD description, the implementation in backend/open_webui/utils/oauth.py (versions 0.9.0 until 0.11.1) has two compounding design flaws:

1. Uncached, repeated network fetches. On each incoming request, the handler fetched the OIDC discovery document and the signing keys before validating the submitted logout token. Because these fetches were not cached, every request — including requests carrying invalid, malformed, or unsigned tokens — triggered fresh outbound network calls to the identity provider. This creates both a server-side load amplifier and an outbound traffic amplifier directed at the IdP.

2. Event-loop blocking. The signing-key lookup is described as blocking the async event loop. In an asynchronous Python framework (the platform is built on FastAPI/Starlette semantics, consistent with the async handler referenced), a synchronous blocking call — such as a synchronous HTTP fetch or blocking filesystem/crypto operation — prevents the event loop from servicing other coroutines. On a single-worker deployment, this serializes and stalls all concurrent requests for the duration of the blocking operation.

The combination means that an attacker needs no authentication (PR:N), no user interaction (UI:N), and can act over the network (AV:N) at low complexity (AC:L). The result is availability loss only (C:N/I:N/A:H), which is exactly the high-availability profile reflected in the CVSS vector. The trigger is conditional on the feature flag ENABLE_OAUTH_BACKCHANNEL_LOGOUT being enabled; when it is disabled, the vulnerable code path is not reachable via this endpoint.

The flaw is classified as CWE-405 (Asymmetric Resource Consumption / Amplification). This is accurate: the attacker sends small requests that compel the server to perform disproportionately expensive work (network fetches plus blocking crypto/key resolution), and the server's resource consumption is asymmetric relative to the attacker's input cost.

It is important to note what the description does not state. There is no claim of token forgery acceptance, no signature-bypass, no authentication bypass, and no code execution. The described defect is a pre-validation resource-consumption flaw, not a cryptographic validation flaw per se. Analysts should not infer that invalid tokens were accepted as valid; the description states the expensive work occurred before validation, implying validation still occurred afterward. The security boundary that is crossed is availability, not confidentiality or integrity.

Exploitation Scenarios

No public exploit is available; the attack chain below is inferred at the vulnerability-class level (resource exhaustion / amplification via an unauthenticated endpoint) strictly from the NVD description. No function names, parameters, or payload formats beyond those explicitly listed in the source are asserted.

1. Reconnaissance / target identification. An attacker scans for internet-exposed Open WebUI instances (self-hosted AI platforms are frequently deployed on public cloud endpoints or reverse-proxied login pages). Because the vulnerable handler sits on the OIDC backchannel logout path, an exposed instance that has OAuth/OIDC single sign-on configured with ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled presents this surface. Shodan queries in the METADATA section can identify candidate hosts by page title, body content, and favicon hash.

2. Triggering the flaw class. The attacker issues repeated unauthenticated POST requests to the documented endpoint, /oauth/backchannel-logout. No valid session or credential is required (PR:N, UI:N). The requests need not carry a validly-signed logout token; per the description, the expensive fetches happen before the token is validated, so invalid tokens still reach the vulnerable code path. The attacker therefore only needs to know the endpoint exists and that the feature flag is active — not the IdP's keys or any secret.

3. Payload / execution method at the class level. Each request causes the server to fetch the OIDC discovery document and signing keys anew (uncached). The signing-key lookup then blocks the async event loop. By sending a modest number of concurrent or paced requests, the attacker forces the worker to spend its time in blocking fetches rather than servicing legitimate traffic. Because each request also generates outbound traffic to the identity provider, the technique simultaneously (a) stalls the Open WebUI worker and (b) causes the IdP to receive amplified request volume. No crafted payload content is required beyond a request to the endpoint; the weaponization is volume and concurrency rather than malformed input exploitation.

4. Post-exploitation impact (availability only). Successful exploitation results in degraded or total unavailability of the Open WebUI instance for legitimate users (A:H). The secondary effect is a denial-of-service amplification toward the configured identity provider — the relying party becomes a traffic source against the IdP. No confidentiality or integrity impact is described. There is no described persistence mechanism, no data exfiltration, and no code execution, so beyond the availability window the described flaw does not hand the attacker a foothold. Recovery is generally a matter of the load subsiding, unless the instance is running as a single worker with no queueing headroom and is left saturated.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

• Attack Vector (Network): The endpoint is reachable over the network; the vulnerability is exploitable remotely.
• Attack Complexity (Low): No special conditions beyond an enabled feature flag and an exposed endpoint are required.
• Privileges Required (None): The handler is unauthenticated, so no account is needed.
• User Interaction (None): Victims need not click or act.
• Scope (Unchanged): The impact is assessed as staying within the vulnerable component's security scope, though the amplification effect propagates load to the identity provider.
• Confidentiality (None) / Integrity (None): The described flaw is availability-only.
• Availability (High): The combination of uncached fetches and event-loop blocking can stall a single-worker instance.

Business impact: Self-hosted Open WebUI deployments are widely used as internal or public-facing AI chat gateways. An outage removes user access to the AI platform, and because backchannel logout is tied to SSO, repeated exploitation can also degrade the identity provider that the organization depends on for authentication across its entire estate. The "blast radius" thus has two rings: the Open WebUI instance itself, and — under amplification — the shared IdP. Single-worker deployments are most severely affected; multi-worker or auto-scaling deployments can absorb or redistribute some of the load but still incur outbound fetch amplification and cost. Because exploitation requires no authentication and no user action, mass, opportunistic scanning is plausible once the CVE becomes widely indexed, even in the absence of a public PoC.

Detection Guidance

Detection focuses on anomalous request volume to the backchannel logout endpoint, correlated outbound traffic to the IdP, and event-loop latency / worker saturation signatures. Rules below are written to the vulnerability class (unauthenticated flood against POST /oauth/backchannel-logout); placeholders for hostnames, IdP domains, and internal field names should be tuned to the local environment.

Sigma Rule

title: Repeated Unauthenticated Requests to Open WebUI OIDC Backchannel Logout Endpoint
id: 8f2c1a4e-7b3d-4c9a-9e21-0d5b6f7a1c88
status: experimental
description: Detects high-volume POST requests to /oauth/backchannel-logout consistent with CVE-2026-87011 availability abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87011
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: open_webui
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|endswith: '/oauth/backchannel-logout'
  timeframe: 1m
  condition: selection | count() by src_ip > 30
fields:
  - src_ip
  - cs-uri-stem
  - sc-status
level: high

YARA Rule

rule CVE_2026_87011_OpenWebUI_BackchannelLogout_Abuse
{
    meta:
        author = "valtersit.com"
        description = "Detects references to Open WebUI OIDC backchannel logout abuse (CVE-2026-87011) in logs and text artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87011"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep   = "/oauth/backchannel-logout" ascii nocase
        $path = "backend/open_webui/utils/oauth.py" ascii nocase
        $flag = "ENABLE_OAUTH_BACKCHANNEL_LOGOUT" ascii nocase
        $cve  = "CVE-2026-87011" ascii nocase

    condition:
        uint16(0) == 0x0a0a or $cve or ($ep and ($path or $flag))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87011 Open WebUI Unauthenticated OIDC Backchannel-Logout Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/oauth/backchannel-logout"; fast_pattern; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-dos; reference:cve,2026-87011; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87011; sid:202687011; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http"
      and http.request.method == "POST"
      and endsWith~(http.request.uri, "/oauth/backchannel-logout") ]
  [ network where network.protocol == "http"
      and http.request.method == "POST"
      and endsWith~(http.request.uri, "/oauth/backchannel-logout") ]
  [ network where network.protocol == "http"
      and http.request.method == "POST"
      and endsWith~(http.request.uri, "/oauth/backchannel-logout") ]

Splunk SPL Query

index=web OR index=proxy sourcetype IN (access_combined, nginx:access, open_webui)
| eval path=coalesce(uri_path, cs_uri_stem)
| where match(path, "^/oauth/backchannel-logout$")
| stats count AS reqs, dc(src_ip) AS sources, values(src_ip) AS attackers BY src_ip
| where reqs > 30
| sort - reqs

Wazuh OSSEC Rule

<group name="open_webui,web,cve-2026-87011,">
  <rule id="2026871" level="10" frequency="30" timeframe="60">
    <if_matched_sid>2026870</if_matched_sid>
    <description>CVE-2026-87011: repeated POST /oauth/backchannel-logout (possible Open WebUI resource-exhaustion/amplification)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability_attack,pci_dss_6.5.9,</group>
  </rule>
  <rule id="2026870" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <url>/oauth/backchannel-logout</url>
    <method>POST</method>
    <description>Open WebUI OIDC backchannel-logout request observed</description>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or OSV package mapping is available in the supplied data; the NVD description states the issue "is fixed in version 0.11.1." Treat that as the reference target, not as verified patch evidence per tracked sources.

1. Immediate mitigations

   • Disable the vulnerable feature path. Set ENABLE_OAUTH_BACKCHANNEL_LOGOUT to disabled. The NVD description ties the vulnerable behavior to this flag being enabled; disabling it removes the reachable code path on the affected versions.
   • Restrict network exposure. Do not expose the Open WebUI instance directly to the internet. Front it with a reverse proxy or gateway that authenticates clients and rate-limits POST /oauth/backchannel-logout. Allow the endpoint only from the trusted identity provider's source addresses.
   • Rate-limit and queue. Apply per-source rate limiting at the reverse proxy and avoid single-worker deployments so a stalled event loop cannot take down the entire capacity pool.
   • Monitor the IdP. Watch for anomalous request volume hitting the OIDC discovery/signing-key endpoints originating from Open WebUI, which signals amplification in progress.

2. Patch / upgrade steps

   • Upgrade Open WebUI to 0.11.1 or later, which the description identifies as the fixed version.
   • Validate the upgrade on a staging instance first, confirming the backchannel logout flow still functions end-to-end with the intended IdP.
   • Re-enable ENABLE_OAUTH_BACKCHANNEL_LOGOUT only after confirming the upgraded version caches discovery/signing-key data and does not block the event loop (per the fix description).
   • Because patch confidence is 0/4, independently verify the fix with the vendor or upstream changelog before relying on the version string alone.

3. Long-term hardening

   • Cache OIDC discovery documents and signing keys with a bounded TTL, and validate logout-token authority claims before any network fetch.
   • Never perform blocking I/O or synchronous key-resolution calls inside async request handlers; offload to a thread pool or async client, and enforce timeouts.
   • Run multi-worker or autoscaling deployments so no single stalled worker can cause a full outage.
   • Enforce rate limits and request-size/timeout caps on all unauthenticated endpoints as a default.
   • Add continuous monitoring and alerting on /oauth/backchannel-logout request rates (see Detection Guidance).

References

• NVD — CVE-2026-87011: https://nvd.nist.gov/vuln/detail/CVE-2026-87011
• Open WebUI project (vendor): https://github.com/open-webui/open-webui
• Open WebUI releases / version 0.11.1 fix reference: https://github.com/open-webui/open-webui/releases
• CWE-405 — Asymmetric Resource Consumption (Amplification): https://cwe.mitre.org/data/definitions/405.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: CISA KEV status is NO; there is no evidence of known exploitation, no public PoC, and no Nuclei template at the time of writing. EPSS has not been scored by FIRST.org for this CVE, so no EPSS value is asserted. The attack chain in this report is therefore a class-level inference and not a validated in-the-wild technique.