{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/time-of-check-time-of-use/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["open-webui (\u003c= 0.8.12)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","time-of-check-time-of-use","race-condition","cve-2026-45675","cloud"],"_cs_type":"advisory","_cs_vendors":["Open Web UI"],"content_html":"\u003cp\u003eOpen WebUI versions 0.8.12 and earlier are vulnerable to a time-of-check-time-of-use (TOCTOU) race condition in the LDAP and OAuth authentication flows. This vulnerability, identified as CVE-2026-45675, occurs because the LDAP and OAuth authentication code paths determine the admin role \u003cem\u003ebefore\u003c/em\u003e inserting the user into the database. This creates a race condition where multiple concurrent requests to a new Open WebUI instance can all observe an empty user database and, consequently, all be assigned the admin role. The vulnerability was resolved in version 0.9.0 with a change to assign a default role upon user creation, then upgrading that role to admin only if the new user is the sole user in the database. This impacts deployments utilizing LDAP or OAuth for authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy Open WebUI version 0.8.12 or earlier on a fresh instance with either LDAP or OAuth enabled for authentication.\u003c/li\u003e\n\u003cli\u003eAn attacker initiates multiple concurrent authentication requests from different user accounts.\u003c/li\u003e\n\u003cli\u003eEach authentication request reaches the \u003ccode\u003ehas_users()\u003c/code\u003e or \u003ccode\u003eget_num_users()\u003c/code\u003e function in \u003ccode\u003eauths.py\u003c/code\u003e or \u003ccode\u003eoauth.py\u003c/code\u003e respectively.\u003c/li\u003e\n\u003cli\u003eDue to the concurrent nature of the requests, multiple requests simultaneously observe an empty user database.\u003c/li\u003e\n\u003cli\u003eThe system incorrectly assigns the \u003ccode\u003eadmin\u003c/code\u003e role to each of these concurrent requests based on the flawed check.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eAuths.insert_new_auth\u003c/code\u003e inserts multiple users, all with the \u003ccode\u003eadmin\u003c/code\u003e role.\u003c/li\u003e\n\u003cli\u003eThe attackers gain unauthorized administrative access to the Open WebUI instance.\u003c/li\u003e\n\u003cli\u003eAttackers can then access sensitive user data, system configurations, API keys, and connected LLM backends.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-45675 allows any LDAP or OAuth user who authenticates concurrently with the initial legitimate administrator to escalate their privileges to full admin. This grants unauthorized access to all user data, system configurations, API keys, and connected LLM backends. The number of affected installations depends on the adoption rate of Open WebUI and the prevalence of LDAP/OAuth usage, but this vulnerability poses a significant risk to data confidentiality and integrity for affected deployments. The fix was released in v0.9.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Open WebUI to version 0.9.0 or later to remediate CVE-2026-45675.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Open WebUI Multiple Admin Account Creation\u0026rdquo; to monitor for potential exploitation attempts (rule below).\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, consider temporarily disabling LDAP/OAuth authentication and relying on local accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-14T20:30:23Z","date_published":"2026-05-14T20:30:23Z","id":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-admin-race/","summary":"Open WebUI versions 0.8.12 and earlier are vulnerable to a time-of-check-time-of-use (TOCTOU) race condition in the LDAP and OAuth authentication flows, allowing multiple concurrent requests on a fresh instance to bypass the first-user admin role assignment and resulting in multiple admin accounts (CVE-2026-45675).","title":"Open WebUI LDAP/OAuth Race Condition Allows Multiple Admin Accounts (CVE-2026-45675)","url":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-admin-race/"}],"language":"en","title":"CraftedSignal Threat Feed — Time-of-Check-Time-of-Use","version":"https://jsonfeed.org/version/1.1"}