Open WebUI LDAP Empty Password Authentication Bypass (GHSA-2r4p-jpmg-48f4)

LDAP Empty Password Authentication Bypass Vulnerability (GHSA-2r4p-jpmg-48f4) Vulnerability Overview There is a security flaw in the LDAP authentication endpoint of Open WebUI. The backend fails to validate whether the submitted password field is empty before invoking the LDAP Simple Bind operation. According to RFC 4513, a Simple Bind using a valid DN and an empty password constitutes an "unauthenticated simple authentication." Many LDAP servers (such as OpenLDAP with default configuration) allow this operation and return success. Since the model in the code does not enforce a minimum length restriction on the password field, attackers can send an empty password. Consequently, the call succeeds, and the application issues a full session token for the target user, leading to a complete authentication bypass. Impact Scope Affected Components: (pip) and (Docker) Affected Versions: Fixed Versions: CVSS Score: 9.1 / 10 (Critical) Attack Vector: Network (Network) Impact: Attackers can take over any LDAP user account (including admin accounts) without knowing the password, gaining full access to chat, files, API keys, and other data. Remediation Upgrade to version 0.9.0 or higher. POC / Exploit Code The exploit snippet provided in the document is as follows: Brief Attack Steps: 1. The attacker sends a POST request to . 2. The request body contains a valid LDAP username, but the password field is an empty string. 3. The backend performs the LDAP bind operation, and the server accepts the empty password, returning success. 4. The backend issues a full session token, allowing the attacker to gain control of the account.

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI LDAP Empty Password Authentication Bypass (GHSA-2r4p-jpmg-48f4)

More from this source