https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 01:38:23 +0000 https://cve.radiocsirt.org/vuln/cve-2026-59715 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-59715 https://cve.radiocsirt.org/vuln/pysec-2026-3599 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The Socket.IO server is configured with `always_connect=True` (lines 78, 91 in `backend/open_webui/socket/main.py`) and the `connect` handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.</p> <p>## Vulnerable Code</p> <p>### `ydoc:awareness:update` (line 741) — No auth check at all ```python @sio.on(&#39;ydoc:awareness:update&#39;) async def yjs_awareness_update(sid, data): document_id = data[&#39;document_id&#39;] user_id = data.get(&#39;user_id&#39;, sid) update = data[&#39;update&#39;] # No SESSION_POOL check, no room membership check await sio.emit( &#39;ydoc:awareness:update&#39;, {&#39;document_id&#39;: document_id, &#39;user_id&#39;: user_id, &#39;update&#39;: update}, room=f&#39;doc_{document_id}&#39;, skip_sid=sid, ) ```</p> <p>### `ydoc:document:leave` (line 711) — No auth check at all ```python @sio.on(&#39;ydoc:document:leave&#39;) async def yjs_document_leave(sid, data): document_id = data[&#39;document_id&#39;] user_id = data.get(&#39;user_id&#39;, sid) # No auth check await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid) await sio.emit(&#39;ydoc:user:left&#39;, {&#39;document_id&#39;: document_id, &#39;user_id&#39;: user_id}, room=f&#39;doc_{document_id}&#39;) ```</p> <p>### Root Cause: `always_connect=True` (line 78) ```python sio = socketio.AsyncServer( always_connect=True, # Never rejects connections ... ) ```</p> <p>The `connect` handler (…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The Socket.IO server is configured with `always_connect=True` (lines 78, 91 in `backend/open_webui/socket/main.py`) and the `connect` handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.</p> <p>## Vulnerable Code</p> <p>### `ydoc:awareness:update` (line 741) — No auth check at all ```python @sio.on(&#39;ydoc:awareness:update&#39;) async def yjs_awareness_update(sid, data): document_id = data[&#39;document_id&#39;] user_id = data.get(&#39;user_id&#39;, sid) update = data[&#39;update&#39;] # No SESSION_POOL check, no room membership check await sio.emit( &#39;ydoc:awareness:update&#39;, {&#39;document_id&#39;: document_id, &#39;user_id&#39;: user_id, &#39;update&#39;: update}, room=f&#39;doc_{document_id}&#39;, skip_sid=sid, ) ```</p> <p>### `ydoc:document:leave` (line 711) — No auth check at all ```python @sio.on(&#39;ydoc:document:leave&#39;) async def yjs_document_leave(sid, data): document_id = data[&#39;document_id&#39;] user_id = data.get(&#39;user_id&#39;, sid) # No auth check await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid) await sio.emit(&#39;ydoc:user:left&#39;, {&#39;document_id&#39;: document_id, &#39;user_id&#39;: user_id}, room=f&#39;doc_{document_id}&#39;) ```</p> <p>### Root Cause: `always_connect=True` (line 78) ```python sio = socketio.AsyncServer( always_connect=True, # Never rejects connections ... ) ```</p> <p>The `connect` handler (…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3599