Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | <= 0.9.5 | 0.9.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in the _process_picture_url function within backend/open_webui/utils/oauth.py. The root cause is that the aiohttp.ClientSession.get method is used to fetch a user-provided URL without disabling redirects. The application performs an initial validation on the URL, but an attacker can provide a URL that passes this check and then redirects to an internal or restricted address. The aiohttp client follows this redirect, and the application processes the response from the internal address as if it were the user's profile picture. This allows an attacker to exfiltrate data from internal services.
The vulnerability was fixed in commit d07fd7d6d85eeee0d4c2a45c01e1d1628081d0ab by adding allow_redirects=AIOHTTP_CLIENT_ALLOW_REDIRECTS to the session.get call. This change prevents the client from following redirects and thus mitigates the SSRF vulnerability. The analysis of the commit confirms that _process_picture_url is the function where the vulnerable code existed and was subsequently patched.
_process_picture_urlbackend/open_webui/utils/oauth.py