Open WebUI Has an Account Takeover Bug. The Admin Session Can Be Yours

• The Mess: Open WebUI has a high-severity authentication flaw in its OAuth identity handling. A crafted OAuth subject can make SQLite resolve the attacker to another stored user — potentially an administrator.
• The Damage: A successful attack can issue the victim’s session and give an unauthenticated attacker administrator-level access to a self-hosted AI platform.
• The Fix: Upgrade Open WebUI to 0.11.1 immediately if you use SQLite.

The Bug Lives in Identity Matching

CVE-2026-87016 affects Open WebUI versions 0.6.41 through 0.11.0 and carries a CVSS 8.1 score. The vulnerable code handled OAuth and SCIM identities through matching logic that became SQL LIKE matching when Open WebUI used SQLite.

The dangerous characters are % and _.

They are not treated purely as ordinary identity data. In SQLite’s LIKE matching, they have wildcard semantics.

That creates an identity-confusion problem.

Turn the OAuth Subject Into a Wildcard

An attacker does not need to guess an administrator’s password.

Instead, the attack abuses the value used to identify the OAuth subject.

A crafted subject containing wildcard characters can match a different identity already stored by Open WebUI. If that identity belongs to an administrator, the application can select the administrator account and issue a session for it.

That’s effectively an authentication bypass through the identity database.

The nasty part is the trust chain:

OAuth identity → database lookup → wrong user → valid session

The authentication system doesn’t necessarily fail loudly.

It can authenticate the wrong person.

SQLite Is the Fault Line

There is an important limitation.

The vulnerability specifically affects deployments using SQLite. PostgreSQL deployments are not affected by this particular flaw.

That matters because Open WebUI is commonly deployed as a self-hosted AI platform, including relatively small installations where SQLite is convenient and perfectly adequate for initial deployment.

Convenient also means easy to forget.

If that instance is exposed to the Internet and uses OAuth, the attack surface deserves immediate attention.

Open WebUI Already Had Other Security Fixes

CVE-2026-87016 landed alongside a cluster of Open WebUI security fixes around version 0.11.1.

The project’s security advisories also document problems involving OAuth token exchange, folder access and chat-history handling. One OAuth issue allowed a previously denied account to retain access through a token-exchange endpoint under specific configurations.

That makes upgrading more sensible than trying to cherry-pick one fix.

Install the current release.

What Defenders Should Check

First, determine whether the deployment uses SQLite.

Then check the Open WebUI version.

Anything below 0.11.1 should be treated as vulnerable to CVE-2026-87016 if the affected SQLite path is in use.

After upgrading, review:

• OAuth configuration
• administrator logins
• unexpected session creation
• new or modified administrator accounts
• unusual authentication activity
• externally exposed Open WebUI instances

If the instance was publicly reachable while vulnerable, don’t assume upgrading proves nobody exploited it.

The patch closes the hole.

It doesn’t erase the logs.

Bugstoday Opinion

This is exactly the kind of AI security bug that gets underestimated.

There is no exotic memory corruption here. No kernel exploit. No spectacular RCE chain.

Just a wildcard character entering an identity lookup.

And suddenly the application can confuse you with the administrator.

AI platforms are becoming full enterprise control planes. Authentication bugs inside them deserve the same paranoia we apply to VPN gateways, firewalls and cloud consoles.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

GitHub Open WebUI Security Advisory — CVE-2026-87016
NVD / CVE-2026-87016
Open WebUI Release 0.11.1
Rapid7 Vulnerability Database — CVE-2026-87016