{
  "affected": [],
  "aliases": [
    "CVE-2016-9880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-16T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker.",
  "id": "GHSA-2qmx-2jj7-w7qw",
  "modified": "2022-05-14T03:32:35Z",
  "published": "2022-05-14T03:32:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9880"
    },
    {
      "type": "WEB",
      "url": "https://pivotal.io/security/cve-2016-9880"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/96146"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-35207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-12T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "** DISPUTED ** An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary PIN. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices.",
  "id": "GHSA-2qrc-66qm-fhmc",
  "modified": "2024-03-21T03:33:56Z",
  "published": "2022-05-24T17:36:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35207"
    },
    {
      "type": "WEB",
      "url": "https://github.com/evilblazer/LastPassVulnerabilities"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/C5j7drIylsQ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-38688"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-29T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later",
  "id": "GHSA-2qvc-r469-79f4",
  "modified": "2022-01-11T00:01:52Z",
  "published": "2021-12-30T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38688"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/qsa-21-55"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-46327"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-02T03:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
  "id": "GHSA-2qwp-p482-jjpc",
  "modified": "2023-11-09T18:34:54Z",
  "published": "2023-11-02T03:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46327"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU96482726/index.html"
    },
    {
      "type": "WEB",
      "url": "https://security.business.xerox.com/en-us/documents/bulletins"
    },
    {
      "type": "WEB",
      "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/1031_addressbook_announce.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12585"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-16T07:16:47Z",
    "severity": "HIGH"
  },
  "details": "The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.",
  "id": "GHSA-2qxh-5338-qmf6",
  "modified": "2026-07-16T18:31:29Z",
  "published": "2026-07-16T09:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12585"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/c94475c8-d129-4735-b599-5094efb20cb8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-16209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T04:17:03Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.",
  "id": "GHSA-2qxj-c4c6-p34f",
  "modified": "2026-07-19T06:30:23Z",
  "published": "2026-07-19T06:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16209"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy/issues/317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy/pull/319"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy/commit/bd4891c60315f17611a3b7a651ffe0fba7cfe71e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-16209"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/857926"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/380025"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/380025/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19873"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-27T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983.",
  "id": "GHSA-2r3h-qggj-vxg9",
  "modified": "2022-05-24T17:35:00Z",
  "published": "2022-05-24T17:35:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19873"
    },
    {
      "type": "WEB",
      "url": "https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T19:38:31Z",
    "nvd_published_at": "2026-05-15T20:16:46Z",
    "severity": "CRITICAL"
  },
  "details": "# LDAP Empty Password Authentication Bypass\n\n## Affected Component\n\nLDAP authentication endpoint:\n- `backend/open_webui/routers/auths.py` (lines 468-477, user bind with empty password)\n- `backend/open_webui/models/auths.py` (lines 58-60, `LdapForm` model)\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions with LDAP authentication support.\n\n## Description\n\nThe LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. Per RFC 4513 Section 5.1.2, a Simple Bind with a valid DN and an empty password constitutes an \"unauthenticated simple authentication\" \u2014 many LDAP servers (including OpenLDAP in default configuration and some Active Directory setups) return success (resultCode 0) for this operation.\n\nThe `LdapForm` Pydantic model accepts `password: str` with no minimum length constraint, so an empty string passes validation. The subsequent `Connection.bind()` call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user.\n\n```python\n# models/auths.py:58-60 \u2014 no min_length on password\nclass LdapForm(BaseModel):\n    user: str\n    password: str\n\n# auths.py:469-477 \u2014 empty password reaches LDAP bind\nconnection_user = Connection(\n    server,\n    user_dn,\n    form_data.password,    # can be \"\"\n    auto_bind=\u0027NONE\u0027,\n    authentication=\u0027SIMPLE\u0027,\n)\nif not await asyncio.to_thread(connection_user.bind):\n    raise HTTPException(400, \u0027Authentication failed.\u0027)\n\n# If bind succeeds (which it does with empty password on many servers),\n# execution continues and a full session token is issued\n```\n\n## CVSS 3.1 Breakdown\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network (N) | Exploited remotely via the LDAP login endpoint |\n| Attack Complexity | Low (L) | Single request with an empty password field |\n| Privileges Required | None (N) | No prior authentication needed |\n| User Interaction | None (N) | No victim interaction required |\n| Scope | Unchanged (U) | Impact within the application\u0027s authentication boundary |\n| Confidentiality | High (H) | Full access to victim\u0027s account data \u2014 chats, files, API keys, settings |\n| Integrity | High (H) | Can modify victim\u0027s data, settings, send messages as victim |\n| Availability | None (N) | No direct denial of service |\n\n## Attack Scenario\n\n1. LDAP authentication is enabled on the Open WebUI instance.\n2. The underlying LDAP server accepts unauthenticated simple binds (OpenLDAP default, some AD configs).\n3. Attacker sends:\n   ```\n   POST /api/v1/auths/ldap\n   {\"user\": \"admin_username\", \"password\": \"\"}\n   ```\n4. The app DN bind succeeds normally (line 366), finds the target user via LDAP search.\n5. The user bind (line 469-477) sends a Simple Bind with the target\u0027s DN and an empty password.\n6. The LDAP server returns success for the unauthenticated bind.\n7. `authenticate_user_by_email` (line 507) issues a full session token for the target user.\n8. Attacker has complete access to the victim\u0027s account.\n\n## Impact\n\n- Complete authentication bypass \u2014 any LDAP user account can be taken over without knowing the password\n- Includes admin accounts if they authenticate via LDAP\n- No rate limiting on the LDAP endpoint (unlike the password signin endpoint)\n- Zero interaction required from the victim\n\n## Preconditions\n\n- LDAP must be enabled (`ENABLE_LDAP=True`, disabled by default)\n- The LDAP server must accept unauthenticated simple binds with empty passwords (OpenLDAP default behavior, configurable on AD)\n- Attacker must know a valid LDAP username",
  "id": "GHSA-2r4p-jpmg-48f4",
  "modified": "2026-05-15T23:52:10Z",
  "published": "2026-05-08T19:38:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44551"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI has an LDAP Empty Password Authentication Bypass"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-1618"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-08T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: \u2022 At the first reboot after performing device factory reset using the command \u201crequest system zeroize\u201d; or \u2022 A temporary moment during the first reboot after the software upgrade when the device configured in Virtual Chassis mode. This issue affects Juniper Networks Junos OS on EX and QFX Series: 14.1X53 versions prior to 14.1X53-D53; 15.1 versions prior to 15.1R7-S4; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S4; 17.1 versions prior to 17.1R2-S11, 17.1R3-S1; 17.2 versions prior to 17.2R3-S3; 17.3 versions prior to 17.3R2-S5, 17.3R3-S6; 17.4 versions prior to 17.4R2-S9, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2; 18.3 versions prior to 18.3R1-S7, 18.3R2. This issue does not affect Juniper Networks Junos OS 12.3.",
  "id": "GHSA-2r53-mrx4-q6h9",
  "modified": "2022-05-24T22:28:05Z",
  "published": "2022-05-24T22:28:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1618"
    },
    {
      "type": "WEB",
      "url": "https://kb.juniper.net/JSA11001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22576"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-26T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).",
  "id": "GHSA-2r69-696x-qxj9",
  "modified": "2024-03-27T15:30:35Z",
  "published": "2022-05-27T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22576"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1526328"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202212-01"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220609-0008"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2022/dsa-5197"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}