# Open WebUI has an LDAP Empty Password Authentication Bypass

Open WebUI's LDAP login passed empty passwords to Simple Bind, which OpenLDAP accepts as unauthenticated, granting full session tokens for any known username.

- Payout: Research
- Severity: critical
- Program: Open WebUI
- Found by: Classic298
- Disclosed: 2026-05-08
- CVE: CVE-2026-44551
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-2r4p-jpmg-48f4
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-2r4p-jpmg-48f4
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:critical tech:python technique:source-review vuln:access-control vuln:auth-bypass

**Target:** LDAP authentication endpoint (/api/v1/auths/ldap)
**Root cause:** LdapForm.password has no min_length constraint and the router performs a Simple Bind without rejecting empty passwords; per RFC 4513 §5.1.2 an empty-password bind is 'unauthenticated simple authentication' and many LDAP servers return success.
**Steps:**
1. Enable LDAP on the instance (ENABLE_LDAP=True) against a server accepting unauthenticated simple binds (OpenLDAP default).
2. Send `POST /api/v1/auths/ldap` with body `{"user": "admin_username", "password": ""}`.
3. App DN bind succeeds, LDAP search resolves the target user's DN.
4. User bind at auths.py:469-477 sends Simple Bind with target DN and empty password; server returns resultCode 0.
5. authenticate_user_by_email (line 507) issues a full session token for the target user.
**How found:** Code review of the LDAP auth flow: noticed LdapForm.password lacked min_length and the bind call passed form_data.password unchecked, then applied RFC 4513 §5.1.2 semantics for empty-password simple binds.
**Exploitation:** Single unauthenticated HTTP request with a known LDAP username and empty password; the LDAP server's success response on the unauthenticated bind causes the app to mint a session token, giving full account access including admin accounts, with no rate limiting on the endpoint.
**Escalation:** Targeting an LDAP-backed admin account yields administrative control of the Open WebUI instance.
**Insight:** Whenever an app delegates auth to LDAP Simple Bind, test empty and null passwords: RFC 4513 makes empty-password binds 'unauthenticated' and many servers (OpenLDAP default) return success, so the app must reject empty passwords before binding.

## Proof of concept (copied exactly from the original report)

**Empty-password LDAP login request**

```
POST /api/v1/auths/ldap
   {"user": "admin_username", "password": ""}
```