Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts (CVE-2026-45675)
Open WebUI versions prior to 0.9.0 contain a race condition in the LDAP and OAuth authentication flows that allows multiple concurrent first-user logins to be assigned the admin role. This occurs because the role assignment checks if any users exist before inserting the new user, creating a time-of-check-time-of-use (TOCTOU) race window. The signup handler was patched to prevent this, but LDAP and OAuth paths were not fixed until version 0.9.0. Exploiting this flaw enables multiple users to gain administrator privileges simultaneously on a fresh instance.
AI Analysis
Technical Summary
The vulnerability in Open WebUI (CVE-2026-45675) arises from a TOCTOU race condition in the LDAP and OAuth authentication flows during first-user admin role assignment. Both flows determine if the user database is empty before inserting a new user with the admin role, allowing multiple concurrent requests to observe an empty database and all receive admin privileges. The signup handler was previously patched to insert users with a default role first and then promote the sole user to admin, but this fix was missing in LDAP and OAuth paths. This race condition enables multiple first users to become admins concurrently. The issue was fixed in version 0.9.0 by applying the insert-first-then-check pattern to LDAP and OAuth registration paths.
Potential Impact
An attacker who times their first LDAP or OAuth login concurrently with the legitimate first admin user can escalate to full administrator privileges. This grants access to all user data, system configuration, API keys, and connected large language model backends. The vulnerability affects fresh Open WebUI instances with no existing users and can result in multiple unauthorized admin accounts.
Mitigation Recommendations
A fix is available in Open WebUI version 0.9.0 and later. Users should upgrade to version 0.9.0 or newer, where the LDAP and OAuth authentication flows have been updated to insert new users with a default role first and then atomically check if they are the sole user before promoting to admin. This eliminates the race condition. Until upgraded, administrators should be aware of the risk of multiple admin accounts being created on fresh deployments using LDAP or OAuth authentication.
Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts (CVE-2026-45675)
Description
Open WebUI versions prior to 0.9.0 contain a race condition in the LDAP and OAuth authentication flows that allows multiple concurrent first-user logins to be assigned the admin role. This occurs because the role assignment checks if any users exist before inserting the new user, creating a time-of-check-time-of-use (TOCTOU) race window. The signup handler was patched to prevent this, but LDAP and OAuth paths were not fixed until version 0.9.0. Exploiting this flaw enables multiple users to gain administrator privileges simultaneously on a fresh instance.
CVSS v3.1
Score 8.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Open WebUI (CVE-2026-45675) arises from a TOCTOU race condition in the LDAP and OAuth authentication flows during first-user admin role assignment. Both flows determine if the user database is empty before inserting a new user with the admin role, allowing multiple concurrent requests to observe an empty database and all receive admin privileges. The signup handler was previously patched to insert users with a default role first and then promote the sole user to admin, but this fix was missing in LDAP and OAuth paths. This race condition enables multiple first users to become admins concurrently. The issue was fixed in version 0.9.0 by applying the insert-first-then-check pattern to LDAP and OAuth registration paths.
Potential Impact
An attacker who times their first LDAP or OAuth login concurrently with the legitimate first admin user can escalate to full administrator privileges. This grants access to all user data, system configuration, API keys, and connected large language model backends. The vulnerability affects fresh Open WebUI instances with no existing users and can result in multiple unauthorized admin accounts.
Mitigation Recommendations
A fix is available in Open WebUI version 0.9.0 and later. Users should upgrade to version 0.9.0 or newer, where the LDAP and OAuth authentication flows have been updated to insert new users with a default role first and then atomically check if they are the sole user before promoting to admin. This eliminates the race condition. Until upgraded, administrators should be aware of the risk of multiple admin accounts being created on fresh deployments using LDAP or OAuth authentication.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h3ww-q6xx-w7x3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-45675"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a58b41668715ace43d68599
Added to database: 07/16/2026, 10:36:06 UTC
Last enriched: 07/16/2026, 10:58:13 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.