CVE-2026-45675

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, he LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment -Insert with default role first to avoid TOCTOU race-, but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.