CVE-2026-87011: Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

The back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. In backend/open_webui/utils/oauth.py, the handler opened a new HTTP session to re-read the discovery document, built a fresh JWKS client with an empty cache, and requested the signing key through a synchronous call on the async event loop. All of that ran before the token signature was verified. Both fetches used a five-minute default timeout.

The advisory measured it against 0.11.0 with the provider answering in 150 ms. 60 concurrent requests carrying a worthless token with a four-character signature stalled the event loop for 8.3 seconds, against an idle baseline of 10.8 ms. During the stall the process answers nothing: no chats, no API calls, no health check. Open WebUI runs a single worker by default and the endpoint has no rate limit. Twenty sequential requests also caused 20 discovery fetches and 40 key-set fetches at the identity provider.

The attacker needs only network access and the issuer string, which the provider's discovery document publishes. No data is read or changed and the forged token is still rejected. Stock installs are not affected, since ENABLE_OAUTH_BACKCHANNEL_LOGOUT defaults to False, but the Open WebUI hardening docs recommend it.

Affected: open-webui 0.9.0 through 0.11.0, with ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true and at least one OIDC provider configured (OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OPENID_PROVIDER_URL). Check:

pip show open-webui

Also check the environment for the back-channel logout flag.

Upgrade to Open WebUI 0.11.1. No configuration change is needed.

pip install --upgrade "open-webui>=0.11.1"

The fix loads the discovery document and signing keys through the already-configured OAuth client, so each is fetched once per provider and reused, and both fetches are async. A token with no kid header is rejected before any key lookup. In the advisory's test the 60-request burst on 0.11.1 finished in under 0.01 s with no outbound fetches. The sources give no other workaround; as a stopgap, leave ENABLE_OAUTH_BACKCHANNEL_LOGOUT at False if you do not need it.

Look for bursts of unauthenticated POSTs to /oauth/backchannel-logout that return 400, with health checks timing out in the same window. At your identity provider, look for spikes in requests for the discovery document and JWKS endpoint from the Open WebUI host: the advisory saw two key-set fetches per request. Event-loop stalls of several seconds under light traffic point to this bug.

Summary

The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network, and repeated both fetches on every request because nothing was cached. The signing-key fetch also ran as a blocking call inside the async event loop. A small number of requests carrying a worthless token was therefore enough to make the whole instance stop answering.

Preconditions

• ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true. The default is False, so a stock deployment is not affected. This setting is recommended in the Open WebUI hardening documentation, which is why the issue is treated as in scope.
• At least one OIDC provider configured (OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OPENID_PROVIDER_URL).
• No account, credential, session or secret identifier is required. The attacker needs network access to the instance and the configured issuer string, which is published in the provider's own discovery document.

Impact

Against 0.11.0, with the identity provider answering in 150 ms, 60 concurrent requests carrying a token whose signature was four characters long stalled the async event loop for 8.3 seconds, measured against an idle baseline of 10.8 ms. For the length of that stall the process answers nothing: no chat requests, no API calls, no health check. Open WebUI runs a single worker by default, so the effect is instance-wide rather than per-connection, and no rate limit sits in front of the endpoint.

The same traffic is also amplified outward: 20 sequential requests produced 20 discovery fetches and 40 key-set fetches at the identity provider, so an attacker can drive load onto the provider through the instance.

No data is read, modified or exposed, and the forged token is still rejected. The cost is paid before the rejection.

Fix

Fixed in 0.11.1. The handler now resolves both the discovery document and the signing keys through the already-configured OAuth client, so each is fetched once per provider and reused afterwards, and both fetches are asynchronous rather than blocking the event loop. A token carrying no kid header is rejected before any key lookup happens. Upgrading is sufficient, and no configuration change is required.

Root cause

Affected component: the OIDC back-channel logout handler in backend/open_webui/utils/oauth.py, reached through POST /oauth/backchannel-logout. Affected setups: releases 0.9.0 through 0.11.0 with back-channel logout enabled and an OIDC provider configured.

The handler treated its network work as cheap preparation rather than as work worth protecting. For every request it opened a new HTTP session per configured provider to re-read the discovery document, then constructed a fresh JWKS client, whose own cache consequently started empty each time, and asked that client for the signing key through a synchronous call issued directly on the event loop. All of this ran before the token signature was verified, so an attacker unable to produce a valid token still cost the server two network round trips and a blocked loop per request. Both fetches used the library default timeout of five minutes.

Proof of concept

Reproduced by running the unmodified handler from the 0.11.0 and 0.11.1 backends against a loopback identity provider that counted every inbound request and could answer with a configured delay. The submitted token carried a valid issuer and audience, a kid naming a key the provider does not hold, and AAAA as its signature.

20 sequential requests, provider answering immediately:

| Version | Discovery fetches | Key-set fetches | Response |
| 0.11.0 | 20 | 40 | 400 |
| 0.11.1 | 1 | 1 | 400 |

60 concurrent requests, provider answering in 150 ms:

| Version | Wall time | Discovery fetches | Key-set fetches | Worst event-loop stall |
| 0.11.0 | 18.6 s | 60 | 120 | 8255 ms |
| 0.11.1 | under 0.01 s | 0 | 0 | none measurable |

Idle event-loop stall was 10.8 ms in both cases. On 0.11.1 the first request an instance receives warms both caches, and every request after that reaches the signature check without any outbound network call.

Credits

@galanko, for reporting the issue and identifying both the missing caching and the blocking call.