Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

## Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network, and repeated both fetches on every request because nothing was cached. The signing-key fetch also ran as a blocking call inside the async event loop. A small number of requests carrying a worthless token was therefore enough to make the whole instance stop answering. ## Preconditions - `ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true`. The default is `False`, so a stock deployment is not affected. This setting is recommended in the Open WebUI hardening documentation, which is why the issue is treated as in scope. - At least one OIDC provider configured (`OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`, `OPENID_PROVIDER_URL`). - No account, credential, session or secret identifier is required. The attacker needs network access to the instance and the configured issuer string, which is published in the provider's own discovery document. ## Impact Against 0.11.0, with the identity provider answering in 150 ms, 60 concurrent requests carrying a token whose signature was four characters long stalled the async event loop for 8.3 seconds, measured against an idle baseline of 10.8 ms. For the length of that stall the process answers nothing: no chat requests, no API calls, no health check. Open WebUI runs a single worker by default, so the effect is instance-wide rather than per-connection, and no rate limit sits in front of the endpoint. The same traffic is also amplified outward: 20 sequential requests produced 20 discovery fetches and 40 key-set fetches at the identity provider, so an attacker can drive load onto the provider through the instance. No data is read, modified or exposed, and the forged token is still rejected. The cost is paid before the rejection. ## Fix Fixed in 0.11.1. The handler now resolves both the discovery document and the signing keys through the already-configured OAuth client, so each is fetched once per provider and reused afterwards, and both fetches are asynchronous rather than blocking the event loop. A token carrying no `kid` header is rejected before any key lookup happens. Upgrading is sufficient, and no configuration change is required. ## Root cause Affected component: the OIDC back-channel logout handler in `backend/open_webui/utils/oauth.py`, reached through `POST /oauth/backchannel-logout`. Affected setups: releases 0.9.0 through 0.11.0 with back-channel logout enabled and an OIDC provider configured. The handler treated its network work as cheap preparation rather than as work worth protecting. For every request it opened a new HTTP session per configured provider to re-read the discovery document, then constructed a fresh JWKS client, whose own cache consequently started empty each time, and asked that client for the signing key through a synchronous call issued directly on the event loop. All of this ran before the token signature was verified, so an attacker unable to produce a valid token still cost the server two network round trips and a blocked loop per request. Both fetches used the library default timeout of five minutes. ## Proof of concept Reproduced by running the unmodified handler from the 0.11.0 and 0.11.1 backends against a loopback identity provider that counted every inbound request and could answer with a configured delay. The submitted token carried a valid issuer and audience, a `kid` naming a key the provider does not hold, and `AAAA` as its signature. 20 sequential requests, provider answering immediately: | Version | Discovery fetches | Key-set fetches | Response | | --- | --- | --- | --- | | 0.11.0 | 20 | 40 | 400 | | 0.11.1 | 1 | 1 | 400 | 60 concurrent requests, provider answering in 150 ms: | Version | Wall time | Discovery fetches | Key-set fetches | Worst event-loop st

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-405, CWE-770

Also known as

CVE-2026-87011

• github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w
• nvd.nist.gov/vuln/detail/CVE-2026-87011
• github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c
• github.com/open-webui/open-webui
• github.com/open-webui/open-webui/releases/tag/v0.11.1