Vulnerabilities

Open WebUI versions 0.6.41 until 0.11.1 contain an authentication flaw in the user-lookup functions get_user_by_oauth_sub and get_user_by_scim_external_id (backend/open_webui/models/users.py): on SQLite, their JSON 'contains' matching compiles to SQL LIKE substring matching, leaving percent (%) and underscore (_) characters unescaped as LIKE wildcards. An OAuth subject or SCIM external ID containing these wildcard characters can therefore resolve to a different stored identity — potentially an administrator account — and the attacker is issued that account's session, effectively an authentication bypass that grants the privileges of the matched account. Exploitation requires unusual conditions (an attacker-controllable identity value with wildcard characters that collides with another account, e.g. an admin), reflected in the high attack complexity of the 8.1 High CVSS score. Only deployments using the SQLite backend with OAuth or SCIM login are affected; PostgreSQL deployments are not. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists as of this analysis.

Do: Upgrade to Open WebUI 0.11.1 or later, which escapes the wildcard matching. If immediate upgrade is not possible, either migrate the backend to PostgreSQL (not affected) or restrict/disable OAuth and SCIM logins, and check whether any user's OAuth sub or SCIM external ID contains '%' or '_' characters that could collide with other accounts — especially administrators. Review active sessions on privileged accounts for logins you cannot attribute.

fast-uri, the OpenJSF/Fastify URI parsing library, fails to validate hosts that contain an unbalanced or misplaced bracket, so parse() returns the malformed string as the host with no error instead of validating it as an IP literal or canonicalizing it as a domain name. The flaw is triggered whenever an attacker-supplied URL with such a host is parsed: applications that read the parsed host to make a security decision — such as an SSRF denylist, redirect allowlist, or proxy routing rule — and then pass the original URL to Node's URL-based HTTP clients send the request to a different host than the one their policy actually checked. An attacker can exploit this discrepancy to bypass host-based controls and reach internal or otherwise restricted destinations (SSRF) or to slip past redirect and proxy restrictions; the malformed host is also carried through normalize, equal, and resolve. Any Node.js application or library using affected fast-uri versions (2.4.5, 3.1.6, 4.1.3 or earlier in those lines) where the parsed host drives network policy is affected. No public proof-of-concept or in-the-wild exploitation is known: EPSS is low at 0.2% and the issue is not in CISA KEV.

Do: Upgrade fast-uri to 2.4.6, 3.1.7, or 4.1.4 (matching your installed major version) and rebuild lockfiles; then audit code paths where fast-uri's parse() host output drives SSRF denylists, redirect allowlists, or proxy routing. As an interim mitigation, derive host decisions from the same URL parser the HTTP client uses (Node's URL) or reject hosts containing brackets that are not valid IPv6 literals.

fast-uri serializes the port component of a URI without validating it, so when the authority is recomposed a non-numeric port value containing characters such as '@' or ':' can inject authority delimiters into the string. Applications that build URIs from parts and assign untrusted data to the port component, then call serialize, normalize, or equal in their object forms, can have the intended host demoted to userinfo and the URI's authority silently repointed at an attacker-controlled host. Both fast-uri and Node's built-in URL parser read the recomposed URI back as the attacker's host without error, so re-validating the built URI does not catch the manipulation, enabling host-allowlist bypass, potential credential exposure via the userinfo component, and integrity-only attacks (CVSS 3.1 7.5, C:N/I:H/A:N). Anyone using fast-uri before 2.4.6, from 3.0.0 before 3.1.7, or from 4.0.0 before 4.1.4 who passes untrusted values into the port component is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation within 30 days, so it is not currently known to be exploited in the wild.

Do: Upgrade fast-uri to 2.4.6 (2.x line), 3.1.7 (3.x line), or 4.1.4 (4.x line), where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986; use 'npm ls fast-uri' or lockfile review to find which of your builds pull in vulnerable versions. Until patched, validate that any user-supplied port is purely numeric before assigning it to the port component, and review SSRF or host-allowlist logic that trusts URIs rebuilt from parts with fast-uri or Node's URL parser.

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as "CN=%s%n" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

OpenEMR through 8.2.0 contains a command-execution flaw in its document category tree component (library/classes/Tree.class.php), where values from the categories database table are passed into an unsanitized eval() call (CWE-95). An attacker who has obtained administrator-level access and can execute arbitrary SQL alters the id column of the categories table to VARCHAR and inserts a PHP payload, which is then executed whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages. Successful exploitation yields arbitrary operating-system command execution as the web server user, providing a persistent foothold until the database tampering is cleaned up. Any OpenEMR deployment running version 8.2.0 or earlier is affected, including self-hosted clinic and health-center installations. Exploitation has not been confirmed in the wild, but two public proof-of-concept write-ups exist, the flaw is rated 9.4 (Critical), EPSS currently estimates a 3.7% probability of exploitation within 30 days (89th percentile), and the issue is not in CISA's KEV catalog.

Do: Upgrade OpenEMR to a release newer than 8.2.0 as soon as the project publishes a patched version, prioritizing internet-exposed instances. Until patched, audit the categories table for tampering (an id column changed to VARCHAR or unexpected stored values), remove arbitrary-SQL capability from untrusted administrator accounts, and restrict the web server user's OS command permissions. Given the public PoCs and rising EPSS, monitor logs for anomalous requests to pages that instantiate CategoryTree and for suspicious commands run as the web server user.

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.