Open WebUIGHSA-7rw5-9f7q-xj36

Open WebUI: Account enumeration via observable login timing discrepancy

CVE-2026-59218 · Published Jul 24, 2026 · updated Aug 4, 2026

Medium5.3

Fix: upgrade to 0.10.0 or later

Summary

The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The expensive bcrypt comparison therefore made valid-account attempts respond significantly slower (~180 ms) than non-existent ones (~5 ms), so an unauthenticated attacker could enumerate valid accounts by measuring response time.

Details

On signin the backend looked the user up by email and only performed the bcrypt password comparison if a record existed. A missing email short-circuited before any hashing, producing the timing gap. The built-in brute-force throttling did not prevent it: sending one request at a time with a small delay between requests stays under the rate limit while still exposing the difference.

Observed in the reporter's run (HTTP 400 for every attempt, the response time is the signal):

Email Status Response time

joe@example.com 400 186 ms <- valid account

larry@example.com 400 9 ms

jose@example.com 400 6 ms

james@example.com 400 5 ms

Impact

An unauthenticated attacker can enumerate which email addresses are registered accounts, which enables targeted password-spraying against...

Affected versions

Package	Affected	Fixed in
open-webui PyPI	< 0.10.0	0.10.0

Details and references

### Summary The `/api/v1/auths/signin` endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The expensive bcrypt comparison therefore made valid-account attempts respond significantly slower (~180 ms) than non-existent ones (~5 ms), so an unauthenticated attacker could enumerate valid accounts by measuring response time. ### Details On signin the backend looked the user up by email and only performed the bcrypt password comparison if a record existed. A missing email short-circuited before any hashing, producing the timing gap. The built-in brute-force throttling did not prevent it: sending one request at a time with a small delay between requests stays under the rate limit while still exposing the difference. Observed in the reporter's run (HTTP 400 for every attempt, the response time is the signal): ``` Email Status Response time joe@example.com 400 186 ms <- valid account larry@example.com 400 9 ms jose@example.com 400 6 ms james@example.com 400 5 ms ``` ### Impact An unauthenticated attacker can enumerate which email addresses are registered accounts, which enables targeted password-spraying against confirmed accounts. The impact is amplified by MFA not being enabled by default. No data is read or modified; the disclosure is limited to account existence. ### Patched The authentication path now runs a bcrypt verification against a constant placeholder hash whenever the email does not resolve to an active credential, so a real hash comparison executes on every attempt and the response time is the same whether or not the account exists. Fixed in 0.10.0. ### Credits @dievus

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-208
Also known as: CVE-2026-59218, PYSEC-2026-3594

More Open WebUI advisories

All Open WebUI

High 7.7Jul 24

open-webui terminal proxy path traversal guard bypass via 9x encoded traversalCVE-2026-59221fixed in 0.10.0 Medium 5.4Jul 24

Open WebUI: Arena task endpoints can bypass underlying model access controlsCVE-2026-59225fixed in 0.10.0 Medium 5.4Jul 24

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/deleteCVE-2026-59212fixed in 0.10.0 High 8.0Jul 24

Open WebUI: server-side request forgeryCVE-2026-59224fixed in 0.10.0 Medium 4.3Jul 24

Open WebUI: protection mechanism failureCVE-2026-59223fixed in 0.10.0 MediumJul 24

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentialsCVE-2026-59222fixed in 0.10.0