mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-07 19:38:46 -05:00
[GH-ISSUE #12611] issue: Signins with passwords that are longer than 71 characters work even when they are trimmed to that length #32186
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#32186
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mrakgr on GitHub (Apr 8, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/12611
Check Existing Issues
Installation Method
Docker
Open WebUI Version
0.6.2
Ollama Version (if applicable)
No response
Operating System
Windows 11
Browser (if applicable)
No response
Confirmation
README.md.Expected Behavior
That only the original password would provide access to the account.
Actual Behavior
Any password which matches the first 71 characters of the password will be allowed.
Steps to Reproduce
Create an account with a large password, greater than 72 characters. Try logging in with the end of it trimmed.
Logs & Screenshots
When I execute the signin endpoint using the actual password, it works.
When I remove a few letters from the end of the password....
It also works. I have to remove quite a bit of the password before it triggers an error....
I'd consider this a major security vulnerability, but I am guessing most users will have passwords less than 72 characters long. Good thing I realized this before going forward with using the API keys as user passwords.
Additional Information
There's nothing interesting in the browser or the docker container logs, so I will skip those.
@mrakgr commented on GitHub (Apr 8, 2025):
I'll change my approach and hash the email in order to derive the password instead.
@tjbck commented on GitHub (Apr 8, 2025):
Bcrypt has a maximum input length of 72 bytes for the password (not characters, but bytes). Any bytes beyond that will be ignored silently.
@tjbck commented on GitHub (Apr 8, 2025):
60d11c1f6f