Open-WebUI Name Field Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Open-WebUI version 0.3.8. The issue allows an unauthenticated attacker to disrupt the Admin panel by entering excessively large text in the 'name' field during the sign-up process. This overloads the system, causing the Admin panel to become unresponsive and hindering administrators from managing users effectively, including actions like deleting, editing, or adding users. Additionally, authenticated users with low privileges can exploit this vulnerability to achieve the same disruptive effect in the Admin panel.

Impact

Exploitation of this vulnerability causes the Admin panel to freeze, disrupting user management tasks such as adding, editing, or deleting users.