CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the database returns first, which can be an administrator. The same defect affects SCIM external-ID resolution. PostgreSQL deployments are not affected, because they take a separate and correct code path.
References
- github.com/advisories/GHSA-wpmr-8h3q-fwj7
- github.com/open-webui/open-webui/commit/73c1f5806aeb6345dad5de8f5aa26d1f3d0bef80
- github.com/open-webui/open-webui/pull/28624
- github.com/open-webui/open-webui/releases/tag/v0.11.1
- github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7
- nvd.nist.gov/vuln/detail/CVE-2026-87016
Code Behaviors & Features
Detect and mitigate CVE-2026-87016 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →