CVE-2026-59715: Open WebUI Socket.IO Authentication Bypass in Collaborative Editing

Technical summary

Open WebUI's Socket.IO server is instantiated with always_connect=True, a permissive configuration that accepts incoming connections without enforcing authentication on all handlers. The ydoc:awareness:update and ydoc:document:leave event handlers—used in Y.js-based collaborative document editing—do not validate that the sender is an authenticated user before processing collaborative state changes. An attacker can connect to the Socket.IO server and emit these events to manipulate document collaboration metadata, potentially corrupting the real-time editing session state. The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function), as the handlers lack proper access controls. Patched in version 0.10.0.

Business impact

If your organization self-hosts Open WebUI and relies on its collaborative document features for team workflows, an attacker could disrupt document editing sessions or inject false collaboration state—for example, spoofing presence information or triggering spurious document-leave events. This could undermine trust in real-time collaboration, cause workflow friction, or enable subtle data integrity issues. The risk is localized to environments using the affected versions; public-facing instances are more exposed than internal-only deployments. No data exfiltration or system availability impact is possible via this flaw.

Affected systems

Open WebUI versions 0.6.16 through 0.9.x are vulnerable. Self-hosted deployments of Open WebUI in these version ranges that expose the Socket.IO interface to untrusted networks are at risk. Verify your version via the application's admin panel or deployment logs. Version 0.10.0 and later are patched.

Exploitability

Exploitability is constrained by two factors: the attacker requires network access to the Socket.IO endpoint (typically behind a firewall in secure deployments) and the attack is not easily automated due to the requirement for proper Y.js document protocol awareness. No public exploit code is known. The attack does not require credentials or phishing, but does require the attacker to understand the collaboration protocol structure. Overall exploitability is moderate in internet-exposed instances and low in air-gapped or internally-accessed deployments.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. If immediate patching is not feasible, restrict network access to the Socket.IO endpoint via firewall rules or reverse-proxy configuration to allow only authenticated internal users. Monitor Socket.IO connection logs for unexpected unauthenticated clients and review collaborative document edit history for signs of unauthorized state manipulation.

Patch guidance

Upgrade to Open WebUI version 0.10.0 or any later release. Follow the vendor's upgrade documentation for your deployment method (Docker, bare-metal, etc.). No breaking changes are documented in the 0.10.0 release notes related to collaboration features. Test in a staging environment if possible, particularly if you use Y.js document collaboration heavily. The upgrade is strongly recommended but carries low risk of operational disruption.

Detection guidance

Monitor Socket.IO server logs for unauthenticated connection attempts and ydoc:awareness:update or ydoc:document:leave events originating from unexpected source IPs. Check application access logs for patterns of failed authentication followed by document-collaboration events. If available, enable debug logging on the collaboration module to trace event handlers. Review document edit timestamps and user presence records for gaps or spoofed entries that don't correlate with known user sessions.

Why prioritize this

Although the CVSS score is LOW (3.1), this vulnerability warrants timely patching because it affects authentication—a foundational security control. Organizations with internet-exposed Open WebUI instances should prioritize this; those with network-restricted access can defer slightly. The fix is simple (version upgrade) and low-risk, making it a good candidate for standard maintenance windows.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N reflects a network-accessible vulnerability with high attack complexity (AC:H) due to the need for protocol knowledge, low integrity impact (I:L, limited to collaboration state), no confidentiality or availability impact, and a requirement for low privileges to connect. The score of 3.1 (LOW severity) correctly captures the limited practical impact—document collaboration sabotage is disruptive but not catastrophic. However, the authentication bypass aspect elevates concern in threat modeling beyond the numeric score.

Frequently asked questions