Sanaan Fayaz Wani

CVE-2026-59715

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

—

GHSA-gmfw-g93r-vg53

Published, fixed and credited. Root cause, the vulnerable code, reproduction and the fix, as published in the advisory itself.

   
Advisory GHSA-gmfw-g93r-vg53
CVE CVE-2026-59715
Severity Low (3.1)
CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE CWE-306 (Missing Authentication for Critical Function)
Published 2026-07-24

Affected versions

Package Ecosystem Vulnerable Fixed in
open-webui pip >= 0.6.16, < 0.10.0 0.10.0

Summary

The Socket.IO server is configured with always_connect=True (lines 78, 91 in backend/open_webui/socket/main.py) and the connect handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.

Vulnerable Code

ydoc:awareness:update (line 741) — No auth check at all

@sio.on('ydoc:awareness:update')
async def yjs_awareness_update(sid, data):
    document_id = data['document_id']
    user_id = data.get('user_id', sid)
    update = data['update']
    # No SESSION_POOL check, no room membership check
    await sio.emit(
        'ydoc:awareness:update',
        {'document_id': document_id, 'user_id': user_id, 'update': update},
        room=f'doc_{document_id}',
        skip_sid=sid,
    )

ydoc:document:leave (line 711) — No auth check at all

@sio.on('ydoc:document:leave')
async def yjs_document_leave(sid, data):
    document_id = data['document_id']
    user_id = data.get('user_id', sid)
    # No auth check
    await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid)
    await sio.emit('ydoc:user:left',
        {'document_id': document_id, 'user_id': user_id},
        room=f'doc_{document_id}')

Root Cause: always_connect=True (line 78)

sio = socketio.AsyncServer(
    always_connect=True,   # Never rejects connections
    ...
)

The connect handler (line 329) adds authenticated users to SESSION_POOL but never returns False or raises an exception for unauthenticated connections.

Exploitation

  1. An unauthenticated attacker connects via Socket.IO (no token needed)
  2. The attacker emits ydoc:awareness:update with:
    • document_id: a known/guessed note UUID (format: note:{uuid})
    • user_id: spoofed to impersonate any user
    • update: arbitrary awareness data (fake cursor positions, selections)
  3. The fake awareness data is broadcast to all legitimate users in the document room
  4. The attacker can also emit ydoc:document:leave with spoofed user_id to broadcast fake ydoc:user:left events

Impact

  • UI disruption: Fake cursor positions and user presence in collaborative editing sessions
  • User impersonation: Attacker can spoof any user_id in awareness updates
  • Resource exhaustion: Unlimited unauthenticated WebSocket connections maintained by the server

Note: Other Ydoc handlers (ydoc:document:join, ydoc:document:update, ydoc:document:state) correctly check SESSION_POOL membership.

Suggested Fix

  1. Set always_connect=False or reject unauthenticated connections in the connect handler
  2. Add SESSION_POOL checks to ydoc:awareness:update and ydoc:document:leave
  3. Add room membership verification before broadcasting to document rooms

AI Disclosure (per Rule 11): AI (Claude) was used to assist with source code review, identifying potential vulnerability patterns, and drafting this report. The researcher directed the analysis, selected focus areas, and independently verified all findings against a running v0.8.12 Docker instance using real HTTP requests with two test accounts. The PoCs included are reproducible and were confirmed live before submission.

References

About this writeup

Sanaan Fayaz Wani (GitHub sfwani) reported this vulnerability to the open-webui maintainers under coordinated disclosure and is credited as a reporter in GHSA-gmfw-g93r-vg53, published 2026-07-24.

All published findings: advisory index.