The vulnerability resides in the authentication endpoint of Open WebUI, where the system only performs bcrypt verification when an email is found in the database. The result is a measurable slowdown for valid accounts versus nonexistent ones, allowing an attacker to distinguish which emails are registered by timing the response. This weakness, classified as CWE-208 unauthenticated enumeration of user accounts, serves as a foothold for targeted credential guessing or social engineering attacks.

The affected product is Open WebUI, a self-hosted AI platform; versions prior to 0.10.0 are impacted. The issue is fixed starting with release v0.10.0.

The CVSS score is 5.3, indicating a medium severity vulnerability. The EPSS score is < 1%, indicating a very low probability of exploitation, and the issue is not listed in KEV. Because the flaw is exploitable over the network with a simple timing measurement technique, the attack vector is likely unauthenticated HTTP requests to the /api/v1/auths/signin endpoint. Attackers can perform the enumeration without possessing valid credentials, but the practical impact depends on the attacker’s follow-up actions, such as phishing or brute‑forcing credentials.