CVE-2026-87011: Open WebUI OIDC Backchannel Logout DoS Flaw

CVE-2026-87011 Overview

Open WebUI, a self-hosted AI platform, contains a resource exhaustion vulnerability in its OpenID Connect (OIDC) back-channel logout handler. Versions 0.9.0 through 0.11.0 expose an unauthenticated POST /oauth/backchannel-logout endpoint that performs uncached network fetches and blocking cryptographic operations before validating the submitted logout token. Attackers can send crafted requests with invalid tokens to stall the single-worker instance and amplify traffic to the upstream identity provider. The issue affects deployments where ENABLE_OAUTH_BACKCHANNEL_LOGOUT is enabled. Version 0.11.1 remediates the flaw.

Critical Impact
Unauthenticated remote attackers can exhaust server resources and generate amplified traffic against the configured identity provider, degrading availability for all Open WebUI users.

Affected Products

Open WebUI versions 0.9.0 through 0.11.0
Deployments with ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled
Single-worker Open WebUI instances relying on OIDC providers

Discovery Timeline

2026-09-09 - CVE-2026-87011 published to NVD
2026-09-09 - Last updated in NVD database
Version 0.11.1 - Open WebUI releases patched version resolving the issue

Technical Details for CVE-2026-87011

Vulnerability Analysis

The flaw resides in the unauthenticated back-channel logout handler defined in backend/open_webui/utils/oauth.py. On every incoming request, the handler fetches the OIDC discovery document and retrieves signing keys from the identity provider before performing any validation on the submitted logout_token. Because neither the discovery document nor the JWKS response is cached, each request triggers fresh outbound HTTP requests to the identity provider.

The signing-key lookup executes synchronously within an asynchronous context, blocking the FastAPI event loop for the duration of each fetch. In a single-worker deployment, concurrent requests queue behind the blocked loop, preventing the server from servicing legitimate traffic.

This matches CWE-405: Asymmetric Resource Consumption (Amplification). An attacker sends a small unauthenticated request, and the server performs disproportionate work while also generating outbound traffic to the OIDC provider.

Root Cause

The root cause is ordering: expensive network I/O and blocking cryptographic key resolution occur before the logout token is parsed or validated. There is no rate limiting on the endpoint, no caching of OIDC metadata, and the JWKS retrieval blocks the async event loop rather than yielding control.

Attack Vector

An unauthenticated attacker sends a high volume of POST requests to /oauth/backchannel-logout containing arbitrary or malformed logout_token form values. Each request forces the server to fetch OIDC discovery metadata and signing keys, stalling the worker and multiplying outbound requests against the upstream identity provider.

python

         sessions via Redis, and deletes their OAuth sessions.
         Returns a JSONResponse per the OIDC Back-Channel Logout 1.0 spec.
         """
-        import jwt as pyjwt
         from fastapi.responses import JSONResponse
 
         # 1. Extract logout_token from form body

Source: GitHub Commit aeda6ff. The patch refactors the handler to defer expensive operations until after basic token validation and to avoid blocking the async loop.

Detection Methods for CVE-2026-87011

Indicators of Compromise

Elevated request volume to POST /oauth/backchannel-logout from a small set of source IPs.
Sustained outbound requests from Open WebUI to the OIDC provider's discovery and JWKS endpoints.
Increased latency or timeouts on unrelated Open WebUI endpoints during traffic spikes.

Detection Strategies

Monitor HTTP access logs for high-frequency unauthenticated calls to /oauth/backchannel-logout.
Correlate Open WebUI worker CPU and event-loop lag metrics with inbound request rates.
Track outbound egress volume to configured OIDC issuer hostnames for anomalous amplification patterns.

Monitoring Recommendations

Instrument the reverse proxy or Web Application Firewall (WAF) to alert on burst traffic against the logout endpoint.
Capture identity provider access logs to identify amplification against JWKS or .well-known/openid-configuration endpoints.
Log rejected logout_token values with source IP metadata to identify probing activity.

How to Mitigate CVE-2026-87011

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later.
If upgrading is not immediately possible, set ENABLE_OAUTH_BACKCHANNEL_LOGOUT to false to disable the vulnerable handler.
Place Open WebUI behind a reverse proxy that enforces rate limiting on /oauth/backchannel-logout.

Patch Information

The fix is available in Open WebUI v0.11.1. Technical remediation details are documented in GHSA-3g9q-v48f-hh9w and the corresponding commit aeda6ff. The patch reorders validation, caches OIDC metadata, and removes blocking calls from the async request path.

Workarounds

Disable back-channel logout by unsetting ENABLE_OAUTH_BACKCHANNEL_LOGOUT until the patch is applied.
Restrict network access to /oauth/backchannel-logout so only the identity provider's egress IP ranges can reach it.
Deploy multiple worker processes to reduce the impact of event-loop stalls on a single worker.

bash

# Disable the vulnerable back-channel logout handler until patched
export ENABLE_OAUTH_BACKCHANNEL_LOGOUT=false

# Example nginx rate limit for the logout endpoint
# limit_req_zone $binary_remote_addr zone=oidc_logout:10m rate=5r/m;
# location = /oauth/backchannel-logout {
#     limit_req zone=oidc_logout burst=5 nodelay;
#     proxy_pass http://open_webui_upstream;
# }