Affected: open-webui

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.

Affected: PyPI: open-webui

## Summary

The Socket.IO server is configured with `always_connect=True` (lines 78, 91 in `backend/open_webui/socket/main.py`) and the `connect` handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.

## Vulnerable Code

### `ydoc:awareness:update` (line 741) — No auth check at all ```python @sio.on('ydoc:awareness:update') async def yjs_awareness_update(sid, data): document_id = data['document_id'] user_id = data.get('user_id', sid) update = data['update'] # No SESSION_POOL check, no room membership check await sio.emit( 'ydoc:awareness:update', {'document_id': document_id, 'user_id': user_id, 'update': update}, room=f'doc_{document_id}', skip_sid=sid, ) ```

### `ydoc:document:leave` (line 711) — No auth check at all ```python @sio.on('ydoc:document:leave') async def yjs_document_leave(sid, data): document_id = data['document_id'] user_id = data.get('user_id', sid) # No auth check await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid) await sio.emit('ydoc:user:left', {'document_id': document_id, 'user_id': user_id}, room=f'doc_{document_id}') ```

### Root Cause: `always_connect=True` (line 78) ```python sio = socketio.AsyncServer( always_connect=True, # Never rejects connections ... ) ```

The `connect` handler (…