The vulnerability resides in the Socket.IO server configuration of Open WebUI versions 0.6.16 through 0.9.x, where the always_connect setting allows any WebSocket client to reach the ydoc:awareness:update and ydoc:document:leave handlers without authentication. Because these handlers manipulate the collaborative document awareness and leave events, an unauthenticated attacker can alter the collaboration state, potentially corrupting document history or disrupting real‑time collaboration. The weakness is a lack of authentication enforcement (CWE-306).

The issue affects the open-webui open-webui product in versions 0.6.16 up to, but not including, 0.10.0.

With a CVSS score of 3.1 the vulnerability is considered low severity. The EPSS score of less than 1% indicates a very low exploitation probability. It is not listed in the CISA KEV catalog. Because authentication is not required for the ydoc:awareness:update and ydoc:document:leave Socket.IO event handlers, any user who can establish a WebSocket connection to the Open WebUI instance can send malicious messages. It is inferred that the attack vector is a network-accessible WebSocket connection, allowing an unauthenticated attacker to alter collaborative document state.