Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8053Improper Authentication in open-webui/open-webui
High 7.5
In plain English
A high-severity missing authentication in open-webui/open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | open-webui | no fix listed | GHSA-9vf8-xgwm-97r8 |
| PyPI | open-webui | 0.5.13 | PYSEC-2026-1725 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-webui | open-webui/open-webui | unspecified – through latest |
Weakness: CWE-306 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H