Open WebUI’s OAuth picture handling contains a server‑side request forgery flaw that arises during the processing of user‑supplied profile image URLs. The _process_picture_url routine validates only the initial URL, then performs an HTTP GET with aiohttp's defaults – redirects enabled (allow_redirects=True), a maximum of 10 hops – and does not honour the AIOHTTP_CLIENT_ALLOW_REDIRECTS environment variable. An attacker who has a legitimate OAuth IdP token can supply a public URL that issues a 302 redirect to an internal address; the backend follows the redirect, retrieves the internal resource, and embeds its body into the attacker’s profile image field. The result is internal data exposure without privilege escalation, identified as CWE‑918. The defect was addressed in Open WebUI 0.9.6.

Open WebUI, a self‑hosted artificial intelligence platform. All deployments running a version older than 0.9.6 are affected by this SSRF flaw.

The CVSS score of 8.5 denotes high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must possess a valid OAuth IdP token and submit a crafted picture URL to trigger the SSRF. Once triggered, the attacker can read the content of internal services reachable from the backend via the internal redirect, without needing privilege escalation. This poses a significant risk to organizations that allow external OAuth integrations and expose internal network services.