{
 "id": "AIR-2026-0704",
 "slug": "cve-2026-45675-open-webui-ldap-and-oauth-admin-race-conditio",
 "title": "CVE-2026-45675: Open WebUI LDAP and OAuth Admin Race Condition",
 "summary": "A TOCTOU race condition in Open WebUI LDAP and OAuth authentication flows allows the creation of multiple administrator accounts. This bypasses the intended restriction limiting admin assignment to the first registered user.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-05-14",
 "incident_date_precision": "day",
 "first_reported": "2026-05-14",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-h3ww-q6xx-w7x3",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-45675: Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts",
   "published_at": "2026-05-14"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45675",
   "publisher": "NVD",
   "title": "CVE-2026-45675: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.",
   "published_at": "2026-05-15"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-45675",
  "toctou",
  "open-webui"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}