CVE-2026-87011

CVE-2026-87011 is an unauthenticated denial-of-service flaw in the OAuth backchannel-logout handler (backend/open_webui/utils/oauth.py) of Open WebUI, affecting versions from 0.9.0 until 0.11.1. When ENABLE_OAUTH_BACKCHANNEL_LOGOUT is enabled, an unauthenticated attacker can send POST requests with invalid logout tokens to /oauth/backchannel-logout, causing the handler to repeatedly fetch the OIDC discovery document and signing keys without caching and to block the async event loop during signing-key lookups. Repeated requests can stall the single-worker instance and amplify traffic toward the identity provider, resulting in a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms there is no confidentiality or integrity impact. Only deployments running affected versions with OAuth backchannel logout enabled are exposed; instances without that setting are not vulnerable. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is currently known.

What to do: Upgrade to Open WebUI 0.11.1 or later. If upgrading is not immediately possible, disable ENABLE_OAUTH_BACKCHANNEL_LOGOUT, restrict or rate-limit access to /oauth/backchannel-logout, and check whether the instance is internet-exposed with the setting enabled.