CVE-2026-87011: CVE-2026-87011: Denial of Service via Event-Loop Starvation in Open WebUI OIDC Back-Channel Logout

#security #cve #cybersecurity

CVE-2026-87011: Denial of Service via Event-Loop Starvation in Open WebUI OIDC Back-Channel Logout

Vulnerability ID: CVE-2026-87011
CVSS Score: 7.5
Published: 2026-09-10

CVE-2026-87011 is a critical vulnerability in Open WebUI versions 0.9.0 through 0.11.0. It allows unauthenticated remote attackers to trigger a Denial of Service (DoS) by sending crafted tokens to the back-channel logout endpoint, causing synchronous network calls that block the single-worker ASGI event loop.

TL;DR

Unauthenticated remote attackers can freeze Open WebUI instances by exploiting a synchronous blocking network call in the OIDC back-channel logout handler.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-405, CWE-770
Attack Vector: Network (AV:N)
CVSS Score: 7.5 (High)
EPSS Score: 0.00339 (0.34%)
Exploit Status: PoC mapped
CISA KEV Status: Not Listed
Remediation: Upgrade to v0.11.1 or disable back-channel logout

Affected Systems

Open WebUI
Open WebUI: >= 0.9.0, < 0.11.1 (Fixed in: 0.11.1)

Code Analysis

Commit: aeda6ff

Fix back-channel logout by using async loading of metadata and jwk set

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or higher
Set ENABLE_OAUTH_BACKCHANNEL_LOGOUT=false in environment configurations
Implement strict rate limiting on /oauth/backchannel-logout via reverse proxies

Remediation Steps:

Verify current Open WebUI version is between 0.9.0 and 0.11.0
Deploy updated Docker image ghcr.io/open-webui/open-webui:v0.11.1
If unable to upgrade immediately, set the environment variable ENABLE_OAUTH_BACKCHANNEL_LOGOUT to false
Verify back-channel logout endpoint responds with 404 or is disabled after configuration change

References

Read the full report for CVE-2026-87011 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community