PT-2025-12137 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-07-18 · CVE-2024-12534

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32

Description The application lacks character length validation on the email and password fields during the sign-in process. This allows users to submit large payloads, potentially leading to a Denial of Service (DoS) condition. Submitting excessively large strings can exhaust server resources, including CPU, memory, and disk space, rendering the service unavailable to legitimate users. The server becomes susceptible to resource exhaustion attacks without authentication.

Recommendations open-webui/open-webui version 0.3.32: Implement character length validation on the email and password input fields to prevent the submission of excessively large payloads.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-12534

GHSA-G3MX-83MP-3RWC

Affected Products

Open-Webui

References · 8

• 🔥 https://huntr.com/bounties/c7c0a4e6-acd3-49b4-8684-2c2c27014b76 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12534 · Security Note
• https://osv.dev/vulnerability/GHSA-g3mx-83mp-3rwc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12534 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/blob/e8babe62bc8e466be0367703fd062a981f5c2394/src/lib/apis/auths/index.ts#L113-L142 · Note
• https://t.me/cvenotify/129509 · Telegram Post
• https://twitter.com/CVEnew/status/1902671059763032377 · Twitter Post