[PR #24214] [CLOSED] fix: the jwt token validation in auth in auth.py #50555

New Issue

GiteaMirror · 2026-04-30T03:20:01-05:00

GiteaMirror commented

2026-04-30 03:20:01 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/24214
Author: @orbisai0security
Created: 4/29/2026
Status: ❌ Closed

Base: main ← Head: fix-v-002-jwt-algorithm-enforcement

📝 Commits (1)

e10e10f fix: V-002 security vulnerability

📊 Changes

1 file changed (+7 additions, -2 deletions)

View changed files

📝 backend/open_webui/utils/auth.py (+7 -2)

📄 Description

Summary

Fix critical severity security issue in backend/open_webui/utils/auth.py.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	`V-002`
File	`backend/open_webui/utils/auth.py:210`

Description: The JWT token validation in auth.py:210-216 may not explicitly enforce the signing algorithm, potentially allowing the 'none' algorithm attack where an attacker strips the signature and sets alg=none to forge arbitrary claims. The OAuth flow in oauth.py:1822 issues JWTs through a potentially different code path, creating inconsistent validation. If the JWT secret key is weak or derived from predictable values, tokens can be brute-forced offline using tools like hashcat.

Changes

backend/open_webui/utils/auth.py

Verification

Build passes
Scanner re-scan confirms fix
LLM code review passed

Automated security fix by OrbisAI Security

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/24214 **Author:** [@orbisai0security](https://github.com/orbisai0security) **Created:** 4/29/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-v-002-jwt-algorithm-enforcement` --- ### 📝 Commits (1) - [`e10e10f`](https://github.com/open-webui/open-webui/commit/e10e10f47c9e9c7fb6cc11e90fbb6d3595e389d8) fix: V-002 security vulnerability ### 📊 Changes **1 file changed** (+7 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/utils/auth.py` (+7 -2) </details> ### 📄 Description ## Summary Fix critical severity security issue in `backend/open_webui/utils/auth.py`. ## Vulnerability | Field | Value | |-------|-------| | **ID** | V-002 | | **Severity** | CRITICAL | | **Scanner** | multi_agent_ai | | **Rule** | `V-002` | | **File** | `backend/open_webui/utils/auth.py:210` | **Description**: The JWT token validation in auth.py:210-216 may not explicitly enforce the signing algorithm, potentially allowing the 'none' algorithm attack where an attacker strips the signature and sets alg=none to forge arbitrary claims. The OAuth flow in oauth.py:1822 issues JWTs through a potentially different code path, creating inconsistent validation. If the JWT secret key is weak or derived from predictable values, tokens can be brute-forced offline using tools like hashcat. ## Changes - `backend/open_webui/utils/auth.py` ## Verification - [x] Build passes - [x] Scanner re-scan confirms fix - [x] LLM code review passed --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)* --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-30 03:20:01 -05:00

GiteaMirror closed this issue

2026-04-30 03:20:04 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#50555