Unauthenticated Account Enumeration in Open WebUI

Executive Summary

CVE-2026-59218 is a timing side channel vulnerability in the Open WebUI platform prior to version 0.10.0. The /api/v1/auths/signin endpoint handled login attempts differently based on whether the email existed in the system. Specifically, password verification using bcrypt was only performed if the email was registered, causing login attempts with valid emails to take longer (~180 ms) than attempts with non-existent emails (~5 ms). This timing difference allowed unauthenticated attackers to enumerate valid user accounts by measuring response times.

The vulnerability was fixed in version 0.10.0 by introducing a placeholder bcrypt hash that is verified for all login attempts, regardless of whether the email exists. This change ensures consistent response times and prevents attackers from distinguishing valid accounts based on timing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to perform account enumeration by measuring the time it takes for the system to respond to login attempts. Knowing which email addresses are registered can facilitate targeted attacks such as phishing, password guessing, or social engineering.

Although the vulnerability does not directly allow password compromise or system access, it leaks sensitive information about user accounts, which can be leveraged in further attacks.

The vulnerability has a moderate severity rating with a CVSS score of 5.3, reflecting its potential impact on confidentiality through information disclosure.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to enumerate valid user accounts by exploiting timing differences in the login process. This could lead to unauthorized disclosure of user existence information.

Such account enumeration issues can impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal data and preventing unauthorized access or disclosure of user information.

By enabling attackers to confirm registered email addresses, the vulnerability increases the risk of targeted attacks or phishing, potentially compromising user privacy and violating regulatory requirements for protecting user identity and access information.

The issue was fixed in version 0.10.0 by ensuring consistent response times during authentication attempts, mitigating the risk of account enumeration and helping maintain compliance with such standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by measuring the response times of the /api/v1/auths/signin endpoint when attempting to sign in with different email addresses.

Specifically, an attacker can observe that login attempts with non-existent emails respond faster (~5 ms) than those with valid emails (~180 ms) due to the bcrypt password verification only running for existing accounts.

To detect this on your system, you can perform timing analysis by sending multiple signin requests with various email addresses and measuring the response times to identify discrepancies.

• Use curl or similar HTTP clients to send POST requests to /api/v1/auths/signin with different email payloads.
• Measure and compare the response times for existing versus non-existing email addresses.
• Example command: curl -X POST https://your-openwebui-instance/api/v1/auths/signin -d '{"email":"[email protected]","password":"any"}' -w "%{time_total}\n" -o /dev/null -s

By automating such requests and analyzing timing differences, you can detect if the vulnerable behavior is present.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Open WebUI to version 0.10.0 or later, where this vulnerability is fixed.

The fix involves running bcrypt password verification against a constant placeholder hash for all login attempts, eliminating timing differences that allow account enumeration.

If upgrading immediately is not possible, consider implementing network-level protections such as rate limiting and monitoring unusual login attempts to reduce the risk of exploitation.

Useful 0 Not Useful 0