Unauthenticated POST requests to the /oauth/backchannel-logout endpoint were able to trigger the server to repeatedly fetch the OIDC discovery document and signing keys prior to validating the logout token. Because each request performed uncached network lookups and the signing‑key lookup blocked the asynchronous event loop, an attacker could send invalid tokens that stalled the single‑worker instance. The stall was exacerbated when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled, amplifying traffic to the identity provider. The result was a denial of service on the Open WebUI server and potential denial of service to the external IDP.

The vulnerability affects Open WebUI versions from 0.9.0 up to and including 0.11.1. The issue was mitigated in the 0.11.1 release, which is the earliest version that no longer exhibits the blocking behavior.

The CVSS score of 7.5 indicates a medium to high severity. EPSS data is not available, but the vulnerability can be exploited remotely without authentication through standard network access to the server. Attackers would need only the ability to craft POST requests to the back‑channel logout endpoint; no elevated privileges or other prerequisites are required. The lack of KEV listing suggests no known widespread exploitation, yet the relatively high CVSS still warrants prompt remediation or mitigation.