CVE-2026-45675: Open WebUI LDAP and OAuth Admin Race Condition

# CVE-2026-45675: Open WebUI LDAP and OAuth Admin Race Condition

https://gcdradar.vercel.app/incidents/cve-2026-45675-open-webui-ldap-and-oauth-admin-race-conditio · AIR-2026-0704 · closed 2026-05-14

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-05-14
- AI role: Attack on AI
- Products: Open WebUI
- CVE ids: CVE-2026-45675
- CVSS: 8.1

## Summary

A TOCTOU race condition in Open WebUI LDAP and OAuth authentication flows allows the creation of multiple administrator accounts. This bypasses the intended restriction limiting admin assignment to the first registered user.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-05-15: CVE-2026-45675: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. (https://nvd.nist.gov/vuln/detail/CVE-2026-45675)
- 2026-05-14: CVE-2026-45675: Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts (https://github.com/advisories/GHSA-h3ww-q6xx-w7x3)

## Sources

- 2026-05-14 GitHub Advisory Database: CVE-2026-45675: Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts https://github.com/advisories/GHSA-h3ww-q6xx-w7x3
- 2026-05-15 NVD: CVE-2026-45675: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. https://nvd.nist.gov/vuln/detail/CVE-2026-45675

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.