PyPI/open-webui CVE-2026-54008: high 8.5, EPSS 0.33%

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Action: Upgrade open-webui to 0.9.6 or later.

pip install open-webui==0.9.6

Affected

Fixed versions

Sources

• osv: GHSA-226f-f24g-524w
• https://github.com/open-webui/open-webui/security/advisories/GHSA-226f-f24g-524w
• https://github.com/open-webui/open-webui

CVE-2026-54008 · published 2026-06-17T14:10:56Z · modified 2026-07-13T16:42:55.257503767Z · JSON