[PR #23253] [CLOSED] fix: the ldap authentication search filter concatena... in auths.py #50152

New Issue

GiteaMirror · 2026-04-30T02:43:46-05:00

GiteaMirror commented

2026-04-30 02:43:46 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23253
Author: @orbisai0security
Created: 3/31/2026
Status: ❌ Closed

Base: main ← Head: fix-fix-ldap-search-filters-injection-v001

📝 Commits (1)

622372d fix: the ldap authentication search filter concatena... in auths.py

📊 Changes

1 file changed (+21 additions, -0 deletions)

View changed files

📝 backend/open_webui/routers/auths.py (+21 -0)

📄 Description

Summary

Fix critical severity security issue in backend/open_webui/routers/auths.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	`V-001`
File	`backend/open_webui/routers/auths.py:386`

Description: The LDAP authentication search filter concatenates the LDAP_SEARCH_FILTERS configuration value directly into the search filter string using an f-string without validation or escaping. While the username is properly escaped using escape_filter_chars(), the LDAP_SEARCH_FILTERS value loaded from environment variables is concatenated without sanitization. An attacker who can control the LDAP_SEARCH_FILTER or LDAP_SEARCH_FILTERS environment variable can inject arbitrary LDAP filter syntax to bypass authentication or extract sensitive directory information.

Changes

backend/open_webui/routers/auths.py

Verification

Build passes
Scanner re-scan confirms fix
Code review passed

Automated security fix by OrbisAI Security

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23253 **Author:** [@orbisai0security](https://github.com/orbisai0security) **Created:** 3/31/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-fix-ldap-search-filters-injection-v001` --- ### 📝 Commits (1) - [`622372d`](https://github.com/open-webui/open-webui/commit/622372dd00d7051ca0c39bd670c67f6be898b475) fix: the ldap authentication search filter concatena... in auths.py ### 📊 Changes **1 file changed** (+21 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/auths.py` (+21 -0) </details> ### 📄 Description ## Summary Fix critical severity security issue in `backend/open_webui/routers/auths.py`. ## Vulnerability | Field | Value | |-------|-------| | **ID** | V-001 | | **Severity** | CRITICAL | | **Scanner** | multi_agent_ai | | **Rule** | `V-001` | | **File** | `backend/open_webui/routers/auths.py:386` | **Description**: The LDAP authentication search filter concatenates the LDAP_SEARCH_FILTERS configuration value directly into the search filter string using an f-string without validation or escaping. While the username is properly escaped using escape_filter_chars(), the LDAP_SEARCH_FILTERS value loaded from environment variables is concatenated without sanitization. An attacker who can control the LDAP_SEARCH_FILTER or LDAP_SEARCH_FILTERS environment variable can inject arbitrary LDAP filter syntax to bypass authentication or extract sensitive directory information. ## Changes - `backend/open_webui/routers/auths.py` ## Verification - [x] Build passes - [x] Scanner re-scan confirms fix - [x] Code review passed --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)* --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-30 02:43:46 -05:00

GiteaMirror closed this issue

2026-04-30 02:43:48 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#50152