Open WebUI uses LDAP and OAuth for user authentication. Before version 0.9.0 the code that assigns the administrator role when the first account is created contains a TOCTOU flaw. An attacker can launch two concurrent first‑user requests, causing the system to treat both as the initial user and assign them the admin role. The vulnerability does not grant remote code execution, but it allows an attacker to create more than one privileged account, thereby escalating privilege and enabling further attacks on the platform.

The affected product is Open WebUI, the open‑source self‑hosted AI platform. All installations prior to 0.9.0 that enable LDAP or OAuth authentication are affected. The fix was applied in the 0.9.0 release.

The CVSS score of 8.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is to trigger parallel first‑user authentication flows, which could be achieved by submitting concurrent requests from an internet‑connected or internal network. The race condition has a low barrier to exploitation once such access is possible, making the threat real but focused on environments where LDAP or OAuth is enabled for new users.