Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | >= 0.8.8, < 0.11.0 | 0.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the WebSocket and Socket.IO authentication paths, which failed to perform a role check after validating a user's JWT. The advisory explicitly mentions the _resolve_authenticated_connection function in backend/open_webui/routers/terminals.py as the root cause for unapproved terminal access. The provided patch confirms this by replacing the inline authentication logic with a call to a new, centralized function get_verified_user_by_token. This new function, added in backend/open_webui/utils/auth.py, correctly performs the role check, ensuring that only users with 'user' or 'admin' roles are considered verified. The analysis of the patch also revealed that several other functions in backend/open_webui/socket/main.py (connect, user_join, join_channel, join_note) suffered from the same vulnerability, as they also performed JWT validation without a role check. The patch remediates this by replacing the vulnerable code in all these locations with calls to the new get_verified_user_by_token function, thus centralizing the authentication logic and enforcing the role check consistently.
_resolve_authenticated_connectionbackend/open_webui/routers/terminals.py
connectbackend/open_webui/socket/main.py
user_joinbackend/open_webui/socket/main.py
join_channelbackend/open_webui/socket/main.py
join_notebackend/open_webui/socket/main.py