Threats tagged 'ghsa-h3ww-q6xx-w7x3'

Open WebUI versions prior to 0.9.0 contain a race condition in the LDAP and OAuth authentication flows that allows multiple concurrent first-user logins to be assigned the admin role. This occurs because the role assignment checks if any users exist before inserting the new user, creating a time-of-check-time-of-use (TOCTOU) race window. The signup handler was patched to prevent this, but LDAP and OAuth paths were not fixed until version 0.9.0. Exploiting this flaw enables multiple users to gain administrator privileges simultaneously on a fresh instance.