Summary
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the database returns first, which can be an administrator. The same defect affects SCIM external-ID resolution. PostgreSQL deployments are not affected, because they take a separate and correct code path.
Preconditions
- The database is SQLite. This is the default backend. PostgreSQL deployments are not affected at all.
- OAuth or OIDC sign-in is configured, or SCIM provisioning is enabled. Both are off by default.
- For an attacker to steer the match deliberately, they must control the value of the claim Open WebUI uses as the subject. That value is normally assigned by the identity provider and is not attacker-controlled: the shipped GitHub and Feishu configurations use provider-assigned numeric identifiers, and a standard OIDC
subis provider-assigned. The deliberate case therefore requires an operator to have pointedOAUTH_SUB_CLAIMat a claim the end user can set at the identity provider, such as a username or email claim, or an identity provider that lets a user choose their own subject value. - No attacker and no misconfiguration are needed for the accidental case. A legitimate subject value that happens to contain an underscore matches other accounts as well, and which account is returned depends on database row order.
- For the SCIM path, the caller must already hold the SCIM bearer token, which is a privileged credential.
Root cause
backend/open_webui/models/users.py,get_user_by_oauth_sub, resolves an OAuth or OIDC identity to a local account.backend/open_webui/models/users.py,get_user_by_scim_external_id, the same pattern for SCIM.- Reached from the OAuth callback handler and the OAuth token-exchange handler, and from the SCIM user routes.
- Affects builds running on SQLite, which is the default database.
The oauth and scim columns are declared with SQLAlchemy's generic JSON type. That type does not implement a containment comparator, so a contains() call against it falls back to the generic string operator and compiles to a LIKE with the operand wrapped in % on both sides. The intent was a JSON containment test; what was emitted was a substring test against the serialized JSON, in which % and _ carry their usual LIKE meaning. The PostgreSQL branch was written separately against JSONB with an equality comparison and is correct, which is why the defect is confined to the default backend and why it survived review: the two branches look symmetrical and only one of them does what it appears to do.
Proof of concept
Against a SQLite instance with an OIDC provider configured, two accounts exist: an administrator whose stored subject is admin_sub_9999, and an ordinary user whose stored subject is bob_sub_1234. Both rows were seeded directly rather than created through a live provider sign-in; the lookup under test was then called as the application calls it.
Resolving the subject value % returns the administrator account. Resolving admin_sub_% likewise returns the administrator account. Resolving the correct full values returns the correct accounts, and resolving an unknown value returns nothing, so the failure is visible only when the supplied value contains a wildcard character. A subsequent check with an ordinary subject value containing an underscore showed it matching more than one account, with the returned account determined by row order.
Credits
Reported by @Classic298.
Impact
A sign-in can be bound to an account other than the one the identity provider authenticated. Where the operator has made the subject claim user-settable, an attacker who registers at that provider can choose a value that matches an existing account and receive a session for it, including an administrator account, which is a full compromise of the instance. Where the subject claim is provider-assigned, the deliberate attack is not available, and what remains is a correctness failure in which an ordinary subject value containing an underscore can resolve to the wrong account and hand one user another user's session non-deterministically.
The defect is in the identity match itself, so it is not mitigated by any downstream permission check: by the time a session is issued the wrong account has already been selected. It does not allow account creation, and it does not affect password sign-in, PostgreSQL deployments, or any deployment with OAuth, OIDC and SCIM all disabled.
The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.
CVE-2026-87016 has a CVSS score of 8.1 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.11.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 0.11.1 by https://github.com/open-webui/open-webui/pull/28624. The two identity lookups now compare the nested JSON value directly through SQLAlchemy's JSON subscript operator, which emits an exact match on both supported databases, instead of going through the column-level contains() operator that degraded to a substring comparison on SQLite. The hand-written per-dialect branching is removed, since the operator already handles both backends.
Upgrading fully resolves it and no configuration change is required. Existing stored identities are unaffected, as the stored format does not change.
Frequently Asked Questions
- What is CVE-2026-87016? CVE-2026-87016 is a high-severity improper authentication vulnerability in open-webui (pip), affecting versions >= 0.6.41, < 0.11.1. It is fixed in 0.11.1. The application does not adequately verify the identity of a user, device, or process before granting access.
- How severe is CVE-2026-87016? CVE-2026-87016 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of open-webui are affected by CVE-2026-87016? open-webui (pip) versions >= 0.6.41, < 0.11.1 is affected.
- Is there a fix for CVE-2026-87016? Yes. CVE-2026-87016 is fixed in 0.11.1. Upgrade to this version or later.
- Is CVE-2026-87016 exploitable, and should I be worried? Whether CVE-2026-87016 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-87016 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-87016? Upgrade
open-webuito 0.11.1 or later.