ADVISORY UNAUTH-2026-0036
TYPE cve
PRODUCT Open WebUI
SEVERITY CRITICAL

CRITICAL

Open WebUI CVE-2026-44551

published 2026-08-05 · updated 2026-08-05

Why it matters

LDAP empty-password authentication bypass: when LDAP auth is enabled and the directory accepts unauthenticated simple binds, an attacker can log in as any user with an empty password. CVSS Critical.

Affected versions

<0.9.0

Fixed in: 0.9.0

Mapping provenance: human-verified against the linked advisory, last checked 2026-07-29.

Fix it

Fix card: cve-2026-44551 →

References

https://github.com/advisories/GHSA-2r4p-jpmg-48f4

Cite this record

unauth.dev advisory UNAUTH-2026-0036 — published 2026-08 · CC-BY 4.0

Canonical URL: https://unauth.dev/advisories/UNAUTH-2026-0036. This record is part of the unauth.dev advisory dataset, published under CC-BY 4.0: attribute "unauth.dev / Raúl Acedo". Schema: additive-only within v1; this id will never be renumbered or reused.