CVE-2026-87016

Executive Summary

CVE-2026-87016 is an identity-resolution flaw in Open WebUI, a self-hosted AI chat platform, affecting versions 0.6.41 through 0.11.0. Two lookup functions in backend/open_webui/models/users.py — get_user_by_oauth_sub and get_user_by_scim_external_id — used JSON containment matching that compiled to SQL LIKE substring semantics on SQLite, so an attacker-controlled OAuth subject or SCIM external ID containing % or _ could match a different stored identity — potentially an administrator — and cause the application to issue that account's session. PostgreSQL deployments are unaffected. The issue is fixed in 0.11.1; no public PoC, exploit code, Nuclei template, or CISA KEV entry exists at the time of writing, and EPSS has not scored it.

Technical Analysis

The vulnerability class here is improper neutralization of wildcard characters in a database query (CWE-155, "Improper Neutralization of Wildcards or Matching Symbols"), which in this specific case produces an authentication/authorization bypass via identity confusion rather than classic SQL injection.

The mechanism, as described by NVD:

• Open WebUI stores federated identities in user records. OAuth-based logins are keyed on a subject value ("OAuth sub"); SCIM-provisioned identities are keyed on an external ID.
• The functions get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py performed JSON "contains" matching against the stored user records.
• On SQLite, that JSON containment predicate was lowered to a LIKE-based substring match. In SQL LIKE semantics, % matches any sequence of characters and _ matches any single character. Consequently, if an attacker can influence the OAuth subject or SCIM external ID that the application resolves, they can supply wildcard characters that match a broader set of rows.
• When the pattern resolves to a different stored identity than the attacker's own, the application continues the authentication flow as that identity. Because the impacted code path is the login/identity-resolution path, a successful match against an administrator record results in the attacker being issued that administrator's session.
• The flaw is backend/database-engine dependent: PostgreSQL deployments were explicitly not affected. JSON containment semantics on PostgreSQL do not degrade into LIKE substring matching, so the wildcard confusion does not occur there. This means the same Open WebUI version can be vulnerable or not depending on its backing database — an important scoping fact for asset inventory.

Attack surface:

• The OAuth callback / federated-login path, where a subject claim from the identity provider is used to look up the local user.
• The SCIM provisioning path, where an external ID supplied by a SCIM client is used for identity lookup.
• Both are network-reachable, pre-authentication surfaces (the OAuth callback in particular is reachable by an unauthenticated attacker), which is consistent with the CVSS vector AV:N/PR:N/UI:N.

CVSS 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Network-exploitable, no privileges and no user interaction required.
• High Attack Complexity (AC:H) — consistent with the need to control the exact subject/external-ID value and to satisfy the surrounding OAuth or SCIM flow conditions.
• High confidentiality, integrity, and availability impact within the same security scope, i.e., full compromise of the targeted Open WebUI instance's data and configuration if the matched identity is an administrator.

Notable constraints on exploitation (derived strictly from the description):

• The attacker must be able to cause the OAuth subject or SCIM external ID value presented to Open WebUI to contain % or _ characters, or must be positioned to influence that value.
• The wildcard pattern must coincidentally (or through deliberate selection) match another record — an administrator record in the worst case.
• The deployment must use SQLite as its database backend.

No public proof-of-concept, exploit code, or Nuclei template is available. The mechanism above is drawn from the NVD description; any wider inference is confined to vulnerability-class behavior.

Exploitation Scenarios

No public PoC is available; the following chain is inferred at the vulnerability-class level from the NVD description and standard behavior of the described authentication path.

1. Reconnaissance / target identification. The attacker identifies internet- or intranet-exposed Open WebUI instances, typically recognized by the Open WebUI web UI title and app assets. The attacker must also determine or infer the deployment's database backend (SQLite versus PostgreSQL); the NVD description makes clear that only SQLite-backed deployments are exploitable, so PostgreSQL instances should be ruled out. Where self-registration or a configured OAuth/SSO provider is exposed, the attacker can proceed unauthenticated. SCIM-based exploitation requires access to, or influence over, the SCIM client that supplies external IDs.

2. Triggering the flaw class. The vulnerability class is wildcard injection into a database match operation. In the OAuth path, the attacker causes a subject value containing wildcard characters (% or _) to be presented to get_user_by_oauth_sub; in the SCIM path, an external ID containing those characters is presented to get_user_by_scim_external_id. On SQLite, this predicate is evaluated as a LIKE substring match, so the supplied pattern matches a set of stored records broader than the single intended identity. If the pattern happens to match an administrator's stored identity, the lookup returns that account.

3. "Payload"/execution at the vulnerability-class level. There is no code-execution payload. The exploitation primitive is an identity selection: the crafted subject or external-ID pattern is submitted during the normal login/provisioning flow, the backend resolves it to the wrong user record, and Open WebUI proceeds with the session-issuance logic for that record. In effect, the wildcard characters act as an authentication bypass, granting a session bound to the matched identity.

4. Post-exploitation impact. If the matched identity is an administrator, the attacker receives that administrator's session and inherits full administrative control of the Open WebUI instance: access to all chat data, model configurations, API keys and provider credentials, user management, and any content the platform can reach. This aligns with the C:H/I:H/A:H rating. Because the mechanism is confined to SQLite deployments, blast radius is scoped to that backend; PostgreSQL deployments remain unaffected per the description.

Impact Assessment

Affected systems: self-hosted Open WebUI deployments running versions 0.6.41 through 0.11.0 that use SQLite as their database backend. PostgreSQL-backed deployments of the same versions are explicitly out of scope for this flaw.

Business impact: horizontal and vertical privilege escalation against an AI platform that commonly aggregates sensitive material — user prompts, uploaded documents, RAG knowledge bases, provider API keys, and workflow integrations. A successful match against an administrator record yields a full instance takeover, giving the attacker the same authority as the platform owner.

CVSS 8.1 mapping:

• Confidentiality: High — the attacker can read all data visible to the hijacked identity, including administrator-visible content.
• Integrity: High — the attacker can modify platform configuration, users, models, and data as the hijacked identity.
• Availability: High — administrative access permits destructive actions (user deletion, service reconfiguration, data removal).
• Attack Vector: Network; Attack Complexity: High (matched-record conditions must be satisfied); Privileges Required: None; User Interaction: None; Scope: Unchanged.

Blast radius is bounded by two real constraints: SQLite-only exploitability and the requirement to satisfy the wildcard-match condition. There is no authentication to the AI provider required beforehand, so exposure is effectively a function of whether the Open WebUI login/SSO surface is reachable and whether SQLite is in use. No CISA KEV listing and no public exploit artifacts currently elevate this beyond a prioritized patching target for exposed instances.

Detection Guidance

Sigma Rule

title: Potential Open WebUI OAuth/SCIM Wildcard Identity Lookup Abuse (CVE-2026-87016)
id: 8a1f2c74-6b0e-4c3d-9f21-870160000001
status: experimental
description: Detects login or SCIM provisioning requests carrying wildcard characters in OAuth subject or SCIM external ID values, consistent with CVE-2026-87016 against SQLite-backed Open WebUI.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87016
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: open_webui
detection:
  selection_oauth:
    cs-uri-stem|contains:
      - '/oauth'
      - '/auth'
    cs-uri-query|contains:
      - 'sub=%'
      - 'sub=_'
      - 'subject=%'
  selection_scim:
    cs-uri-stem|contains:
      - '/scim'
    cs-uri-query|contains:
      - 'externalId=%'
      - 'externalId=_'
  condition: selection_oauth or selection_scim
falsepositives:
  - Legitimate OAuth subjects or SCIM external IDs that genuinely contain underscore characters (common in some IdP subject formats) - tune to wildcard-only patterns.
level: medium
tags:
  - attack.t1190
  - cve.2026.87016

YARA Rule

rule CVE_2026_87016_OpenWebUI_Wildcard_Identity_Lookup
{
    meta:
        description = "Detects Open WebUI versions vulnerable to CVE-2026-87016 by scanning source files for the impacted identity lookup functions in backend/open_webui/models/users.py"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87016"
        date = "2026-01-01"
        severity = "high"

    strings:
        $f1 = "get_user_by_oauth_sub" ascii
        $f2 = "get_user_by_scim_external_id" ascii
        $p1 = "backend/open_webui/models/users.py" ascii
        $j1 = "contains" ascii
        $j2 = "LIKE" ascii

    condition:
        (uint16(0) == 0x3f3c or uint32(0) == 0x6f0a2d23 or true) and
        (
            ($f1 and $f2) or
            ($p1 and ($f1 or $f2))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87016 Open WebUI OAuth/SCIM wildcard identity lookup attempt"; flow:to_server,established; http.uri; content:"%25"; nocase; pcre:"/(sub|subject|externalId)=[^&]*[%25_]/i"; classtype:attempted-admin; reference:cve,2026-87016; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87016; sid:2026870160; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where url.path : ("*oauth*", "*auth*", "*scim*") and url.query : ("*sub=*%*", "*subject=*%*", "*externalId=*%*", "*sub=*_*", "*externalId=*_*") ]
  [ network where url.path : ("*oauth*", "*auth*", "*scim*") and http.response.status_code in (200, 302) ]

Splunk SPL Query

index=web OR index=proxy sourcetype in (access_combined, open_webui:access)
| eval uri_path = coalesce(uri_path, url, cs_uri_stem)
| eval uri_query = coalesce(uri_query, cs_uri_query)
| where (like(uri_path, "%oauth%") OR like(uri_path, "%/auth%") OR like(uri_path, "%/scim%"))
| where (match(uri_query, "(?i)(sub|subject|externalId)=[^&]*(%25|_)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(uri_query) as queries by src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="open_webui,web,">
  <rule id="20287016" level="10">
    <if_sid>31100</if_sid>
    <id>^/?(oauth|auth|scim)</id>
    <url>sub=|subject=|externalId=</url>
    <regex type="pcre2">(?i)(sub|subject|externalId)=[^&]*(%25|_)</regex>
    <description>CVE-2026-87016: Open WebUI OAuth/SCIM identity lookup with wildcard characters from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87016,authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Treat all version guidance as unverified until the vendor advisory and released artifacts can be independently confirmed.

1. Immediate mitigations

• Restrict network exposure: place Open WebUI behind an authenticated reverse proxy or VPN and do not expose the OAuth callback or SCIM endpoints to untrusted networks. This directly removes the AV:N path.
• Where technically feasible, migrate the backend database from SQLite to PostgreSQL, which the NVD description states is not affected by this flaw. Validate the migration against a current backup and re-test identity mapping (OAuth subject and SCIM external ID uniqueness) before cutover.
• Disable self-registration and any unauthenticated identity flows; restrict SCIM provisioning to trusted clients on management networks only.
• Audit configured OAuth providers for any subject formats that may contain % or _, and review how those subjects are mapped to local accounts today.
• Apply virtual patching at the WAF/reverse-proxy layer by rejecting requests whose OAuth subject or SCIM external-ID parameter contains wildcard characters.

2. Patch / upgrade steps

• The NVD description states the issue is fixed in Open WebUI 0.11.1. Update to 0.11.1 or later, taking a full pre-upgrade backup of the SQLite database and configuration.
• After upgrade, re-verify the identity lookup functions and confirm that subject/external-ID resolution is exact rather than substring-based.
• Since no vendor advisory is cited in the intake data, obtain the upgrade artifact from the official Open WebUI distribution channel and verify signatures/hashes before deployment.

3. Long-term hardening

• Standardize on a production-grade database backend (PostgreSQL) for all deployments to avoid SQLite-specific query semantics diverging from tested behavior.
• Add unit and integration tests that assert wildcard characters in identity claims (%, _) never resolve to a different account.
• Implement database-backed uniqueness constraints on OAuth subject and SCIM external ID so even a degrading lookup cannot collapse two identities.
• Monitor identity-mapping anomalies (an unexpected account matched for a given subject) and alert on login events where the resolved user differs from the expected provider identity.
• Enforce least privilege for administrators, require phishing-resistant MFA at the identity provider, and log session issuance with the resolved user ID and the presented subject for forensic correlation.

References

• NVD — CVE-2026-87016: https://nvd.nist.gov/vuln/detail/CVE-2026-87016
• Open WebUI project (official repository/releases) — confirm the 0.11.1 fixed release and advisory: https://github.com/open-webui/open-webui
• CWE-155 — Improper Neutralization of Wildcards or Matching Symbols: https://cwe.mitre.org/data/definitions/155.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-87016 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/

Exploit-in-the-wild status: no public PoC, exploit code, or Nuclei template is available; no CISA KEV listing; no threat-actor campaign associated with this CVE has been reported in the provided intake data.