CVE-2026-45675

## Summary The LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (`signup_handler` in auths.py, line 663) was explicitly patched to prevent this race with the comment *"Insert with default role first to avoid TOCTOU race"*, but the LDAP and OAuth code paths were never updated with the same fix. ## Vulnerable Code ### LDAP (auths.py, lines 479-490) ```python # Line 482 - CHECK: is the user table empty? role = 'admin' if not Users.has_users(db=db) else request.app.state.config.DEFAULT_USER_ROLE # Lines 484-490 - USE: create user with the role determined above user = Auths.insert_new_auth( email=email, password=str(uuid.uuid4()), name=cn, role=role, # <-- role was determined BEFORE insert, race window exists db=db, ) ``` ### OAuth (oauth.py, lines 1103-1112, 1566-1574) ```python # Line 1104 - CHECK: count users def get_user_role(self, user, user_data): user_count = Users.get_num_users() if not user and user_count == 0: return 'admin' # Line 1112 # Lines 1566-1574 - USE: create user with pre-determined role user = Auths.insert_new_auth( ... role=self.get_user_role(None, user_data), # Line 1571 ... ) ``` Both paths determine the role BEFORE inserting the user, creating a race window where multiple concurrent requests on a fresh instance can all observe an empty database and all receive the `admin` role. ## Comparison with Patched Signup The `signup_handler` (auths.py, line 663) was explicitly fixed: ```python # Insert with default role first to avoid TOCTOU race user = Auths.insert_new_auth(..., role=DEFAULT_USER_ROLE, ...) # Then check if this is the only user and upgrade if Users.get_num_users() == 1: Users.update_user_role_by_id(user.id, 'admin') ``` The LDAP and OAuth paths did NOT receive this fix. ## Exploitation 1. Deploy Open WebUI with LDAP or OAuth enabled on a fresh instance (no existing users