CVE-2026-45396: Open WebUI Auth Bypass Vulnerability

CVE-2026-45396 Overview

CVE-2026-45396 is a mass assignment vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw affects the POST /api/v1/evaluations/feedback endpoint in versions prior to 0.9.5. The FeedbackForm model uses model_config = ConfigDict(extra='allow'), which permits arbitrary extra fields in submitted requests. An authenticated attacker can inject a user_id field that overwrites the server-derived value, attributing feedback records to any arbitrary user. The vendor released a fix in version 0.9.5.

Critical Impact
Authenticated attackers can spoof user identity in feedback submissions, corrupting model evaluation leaderboards and Elo ratings while attributing records to other users.

Affected Products

Open WebUI versions prior to 0.9.5
Open WebUI v0.9.2 (confirmed vulnerable)
Self-hosted Open WebUI deployments using the evaluations feedback API

Discovery Timeline

2026-05-15 - CVE-2026-45396 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45396

Vulnerability Analysis

The vulnerability is classified under [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes]. Open WebUI exposes an authenticated endpoint at POST /api/v1/evaluations/feedback that accepts a FeedbackForm Pydantic model. The model declaration uses ConfigDict(extra='allow'), which instructs Pydantic to accept and retain attributes not declared in the schema. This configuration is the precondition for mass assignment.

The insert_new_feedback() function then merges the user-supplied payload with server-side fields in an insecure order. Because the user-controlled dictionary is applied after the server-derived user_id, the attacker-supplied value takes precedence. The merged record is persisted, attributing the feedback to a chosen target user.

Root Cause

The root cause is twofold. First, the FeedbackForm schema permits undeclared attributes through extra='allow'. Second, insert_new_feedback() performs a dictionary merge where attacker-controlled keys overwrite trusted server-derived keys. Neither layer enforces a deny-list or explicit field allow-list for sensitive identifiers such as user_id.

Attack Vector

Exploitation requires a valid authenticated session against the Open WebUI instance. The attacker sends a crafted JSON body to POST /api/v1/evaluations/feedback containing a user_id field set to the victim's identifier along with feedback content. The server processes the request, accepts the injected attribute, and writes a feedback record bound to the spoofed user. This corrupts model evaluation leaderboards and Elo ratings and enables identity spoofing within the platform.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-rjmp-vjf2-qf4g for the vendor's technical writeup.

Detection Methods for CVE-2026-45396

Indicators of Compromise

Feedback records in the Open WebUI database whose user_id does not match the authenticated session that created the record
Sudden anomalous shifts in model evaluation leaderboard Elo ratings without corresponding user activity
HTTP requests to /api/v1/evaluations/feedback containing a user_id field in the JSON body

Detection Strategies

Inspect application logs for POST /api/v1/evaluations/feedback requests and compare the authenticated session identifier against any user_id field present in the request payload.
Run database integrity queries that join feedback records to session or audit logs and surface records where the recorded user_id differs from the authenticating principal.
Alert on requests containing extra attributes beyond the documented FeedbackForm schema fields.

Monitoring Recommendations

Forward Open WebUI access logs and application logs to a centralized analytics platform for retrospective hunting.
Track per-user feedback submission rates and flag accounts whose attributed feedback volume diverges sharply from session activity.
Monitor changes to the Open WebUI evaluation leaderboard for unexplained ranking changes that may indicate manipulation.

How to Mitigate CVE-2026-45396

Immediate Actions Required

Upgrade Open WebUI to version 0.9.5 or later, which removes the mass assignment condition.
Audit the feedback table for records whose user_id cannot be reconciled with session or audit logs and remove or quarantine spoofed entries.
Restrict network access to the Open WebUI API to trusted users while patching is in progress.

Patch Information

The vendor fixed CVE-2026-45396 in Open WebUI 0.9.5. The fix corrects the dictionary merge order in insert_new_feedback() so that server-derived identifiers cannot be overridden by client input. Full details are available in the Open WebUI Security Advisory GHSA-rjmp-vjf2-qf4g.

Workarounds

If upgrading is not immediately possible, place an authenticating reverse proxy in front of Open WebUI and strip or reject any request body containing a user_id field on the /api/v1/evaluations/feedback route.
Disable the evaluations feedback feature for untrusted users until the patch is applied.
Rebuild Elo leaderboards from validated records after removing entries identified as spoofed.

bash

# Example: block requests carrying a user_id field on the feedback endpoint (NGINX)
location /api/v1/evaluations/feedback {
    if ($request_body ~* "\"user_id\"") {
        return 400;
    }
    proxy_pass http://openwebui_upstream;
}