PT-2026-39268 · Unknown · Open-Webui

CVE-2026-44551 · Published 2026-05-05 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0

Description Open WebUI fails to validate that passwords are non-empty before performing LDAP Simple Bind authentication. On LDAP servers that permit unauthenticated empty-password binds, an attacker can authenticate as any valid LDAP user, including administrators, without knowing the credentials. This occurs because the LdapForm model does not enforce a minimum length for the password variable, allowing an empty string to reach the Connection.bind() function. If the LDAP server returns a success result for this operation, the application issues a full session token, leading to complete account takeover. The issue is exploitable via the '/api/v1/auths/ldap' endpoint by providing a valid username and an empty password.

Recommendations Update to version 0.9.0. As a temporary workaround, restrict access to the '/api/v1/auths/ldap' endpoint or disable LDAP authentication by setting ENABLE LDAP to False until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-07029

CVE-2026-44551

GHSA-2R4P-JPMG-48F4

PYSEC-2026-435

Affected Products

Open-Webui

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44551.json · Exploit
• https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07029 · Security Note
• https://osv.dev/vulnerability/GHSA-2r4p-jpmg-48f4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44551 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44551 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/advisories/GHSA-2r4p-jpmg-48f4 · Note
• https://pypi.org/project/open-webui · Note
• https://twitter.com/TechTranslators/status/2052858876358189183 · Twitter Post
• https://twitter.com/fofabot/status/2056698356299370609 · Twitter Post
• https://twitter.com/CVEnew/status/2055457528629116934 · Twitter Post
• https://twitter.com/infoflowcloud/status/2055458447273902190 · Twitter Post
• https://twitter.com/UpwindMDR/status/2053144849046450250 · Twitter Post