Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44551: Open WebUI lets anyone log in with empty password

CVE-2026-44551 · published 5 months ago

Summary

Versions of Open WebUI before 0.9.0 accept an empty password when connecting to an LDAP directory, allowing a user to obtain a valid session token without proper credentials. This means an attacker could log in as any LDAP user and access the system. Upgrade Open WebUI to version 0.9.0 or later to enforce password entry and close the gap.

What to do

Update timothy jaeryang baek open-webui to version 0.9.0.
Update openwebui open_webui to version 0.9.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
pip	timothy jaeryang baek	open-webui	<= 0.8.12 Fix: upgrade to 0.9.0
–	openwebui	open_webui	< 0.9.0 `cpe:2.3:a:openwebui:open_webui::::::::`

Original advisory text

Open WebUI: LDAP Empty Password Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.

References

https://github.com/advisories/GHSA-2r4p-jpmg-48f4
https://nvd.nist.gov/vuln/detail/CVE-2026-44551 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44551... Vendor Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.1 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published15 May 2026

Updated3 Nov 2026

First seen8 May 2026

Sources

GHSA-2r4p-jpmg-48f4 · GHSA

CVE-2026-44551 · NVD

CVE-2026-44551 · OSV

Track software like this

Free during beta