Vendor
Open WebUI is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation in the `validate_url()` function, allowing authenticated users to access internal IPv4 and IPv6 addresses, potentially leading to IAM credential exfiltration.