Open WebUI: missing authentication

## Summary The Socket.IO server is configured with `always_connect=True` (lines 78, 91 in `backend/open_webui/socket/main.py`) and the `connect` handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions. ## Vulnerable Code ### `ydoc:awareness:update` (line 741) , No auth check at all ```python @sio.on('ydoc:awareness:update') async def yjs_awareness_update(sid, data): document_id = data['document_id'] user_id = data.get('user_id', sid) update = data['update'] # No SESSION_POOL check, no room membership check await sio.emit( 'ydoc:awareness:update', {'document_id': document_id, 'user_id': user_id, 'update': update}, room=f'doc_{document_id}', skip_sid=sid, ) ``` ### `ydoc:document:leave` (line 711) , No auth check at all ```python @sio.on('ydoc:document:leave') async def yjs_document_leave(sid, data): document_id = data['document_id'] user_id = data.get('user_id', sid) # No auth check await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid) await sio.emit('ydoc:user:left', {'document_id': document_id, 'user_id': user_id}, room=f'doc_{document_id}') ``` ### Root Cause: `always_connect=True` (line 78) ```python sio = socketio.AsyncServer( always_connect=True, # Never rejects connections ... ) ``` The `connect` handler (line 329) adds authenticated users to `SESSION_POOL` but never returns `False` or raises an exception for unauthenticated connections. ## Exploitation 1. An unauthenticated attacker connects via Socket.IO (no token needed) 2. The attacker emits `ydoc:awareness:update` with: - `document_id`: a known/guessed note UUID (format: `note:{uuid}`) - `user_id`: spoofed to impersonate any user - `update`: arbitrary awareness data (fake cursor positions, selections) 3. The fake awareness data is broadcast to all legitimate users in the document room 4. The attacker can also emit `ydoc:document:leave` with spoofed `user_id` to broadcast fake `ydoc:user:left` events ## Impact - **UI disruption**: Fake cursor positions and user presence in collaborative editing sessions - **User impersonation**: Attacker can spoof any `user_id` in awareness updates - **Resource exhaustion**: Unlimited unauthenticated WebSocket connections maintained by the server Note: Other Ydoc handlers (`ydoc:document:join`, `ydoc:document:update`, `ydoc:document:state`) correctly check `SESSION_POOL` membership. ## Suggested Fix 1. Set `always_connect=False` or reject unauthenticated connections in the `connect` handler 2. Add `SESSION_POOL` checks to `ydoc:awareness:update` and `ydoc:document:leave` 3. Add room membership verification before broadcasting to document rooms --- > **AI Disclosure (per Rule 11):** AI (Claude) was used to assist with source code review, identifying potential vulnerability patterns, and drafting this report. The researcher directed the analysis, selected focus areas, and independently verified all findings against a running v0.8.12 Docker instance using real HTTP requests with two test accounts. The PoCs included are reproducible and were confirmed live before submission.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-306

Also known as

CVE-2026-59715, PYSEC-2026-3599

• github.com/open-webui/open-webui/security/advisories/GHSA-gmfw-g93r-vg53
• nvd.nist.gov/vuln/detail/CVE-2026-59715
• github.com/open-webui/open-webui/pull/25946
• github.com/open-webui/open-webui/commit/22f2fe1ffb66c993dad1e0b2b35514acaed2370e
• github.com/open-webui/open-webui
• github.com/open-webui/open-webui/releases/tag/v0.10.0