Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment "Insert with default role first to avoid TOCTOU race", but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.

Affected: PyPI: open-webui

## Summary

The LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (`signup_handler` in auths.py, line 663) was explicitly patched to prevent this race with the comment *"Insert with default role first to avoid TOCTOU race"*, but the LDAP and OAuth code paths were never updated with the same fix.

## Vulnerable Code

### LDAP (auths.py, lines 479-490) ```python # Line 482 - CHECK: is the user table empty? role = 'admin' if not Users.has_users(db=db) else request.app.state.config.DEFAULT_USER_ROLE

# Lines 484-490 - USE: create user with the role determined above user = Auths.insert_new_auth( email=email, password=str(uuid.uuid4()), name=cn, role=role, # <-- role was determined BEFORE insert, race window exists db=db, ) ```

### OAuth (oauth.py, lines 1103-1112, 1566-1574) ```python # Line 1104 - CHECK: count users def get_user_role(self, user, user_data): user_count = Users.get_num_users() if not user and user_count == 0: return 'admin' # Line 1112

# Lines 1566-1574 - USE: create user with pre-determined role user = Auths.insert_new_auth( ... role=self.get_user_role(None, user_data), # Line 1571 ... ) ```

Both paths determine the role BEFORE inserting the user, creating a race window where multiple concurrent requests on a fresh instance can all observe an empty database and all receive the `admin` role.

## Comparison wit…

Affected: PyPI: open-webui

## Summary

The LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (`signup_handler` in auths.py, line 663) was explicitly patched to prevent this race with the comment *"Insert with default role first to avoid TOCTOU race"*, but the LDAP and OAuth code paths were never updated with the same fix.

## Vulnerable Code

### LDAP (auths.py, lines 479-490) ```python # Line 482 - CHECK: is the user table empty? role = 'admin' if not Users.has_users(db=db) else request.app.state.config.DEFAULT_USER_ROLE

# Lines 484-490 - USE: create user with the role determined above user = Auths.insert_new_auth( email=email, password=str(uuid.uuid4()), name=cn, role=role, # <-- role was determined BEFORE insert, race window exists db=db, ) ```

### OAuth (oauth.py, lines 1103-1112, 1566-1574) ```python # Line 1104 - CHECK: count users def get_user_role(self, user, user_data): user_count = Users.get_num_users() if not user and user_count == 0: return 'admin' # Line 1112

# Lines 1566-1574 - USE: create user with pre-determined role user = Auths.insert_new_auth( ... role=self.get_user_role(None, user_data), # Line 1571 ... ) ```

Both paths determine the role BEFORE inserting the user, creating a race window where multiple concurrent requests on a fresh instance can all observe an empty database and all receive the `admin` role.

## Comparison wit…