Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

The Socket.IO server is configured with always_connect=True (lines 78, 91 in backend/open_webui/socket/main.py) and the connect handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.

ydoc:awareness:update (line 741) — No auth check at all

 1@sio.on('ydoc:awareness:update')
 2async def yjs_awareness_update(sid, data):
 3    document_id = data['document_id']
 4    user_id = data.get('user_id', sid)
 5    update = data['update']
 6    # No SESSION_POOL check, no room membership check
 7    await sio.emit(
 8        'ydoc:awareness:update',
 9        {'document_id': document_id, 'user_id': user_id, 'update': update},
10        room=f'doc_{document_id}',
11        skip_sid=sid,
12    )

ydoc:document:leave (line 711) — No auth check at all

 1@sio.on('ydoc:document:leave')
 2async def yjs_document_leave(sid, data):
 3    document_id = data['document_id']
 4    user_id = data.get('user_id', sid)
 5    # No auth check
 6    await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid)
 7    await sio.emit('ydoc:user:left',
 8        {'document_id': document_id, 'user_id': user_id},
 9        room=f'doc_{document_id}')

Root Cause: always_connect=True (line 78)

 1sio = socketio.AsyncServer(
 2    always_connect=True,   # Never rejects connections
 3    ...
 4)

The connect handler (line 329) adds authenticated users to SESSION_POOL but never returns False or raises an exception for unauthenticated connections.

1. An unauthenticated attacker connects via Socket.IO (no token needed)
2. The attacker emits ydoc:awareness:update with:
   • document_id: a known/guessed note UUID (format: note:{uuid})
   • user_id: spoofed to impersonate any user
   • update: arbitrary awareness data (fake cursor positions, selections)
3. The fake awareness data is broadcast to all legitimate users in the document room
4. The attacker can also emit ydoc:document:leave with spoofed user_id to broadcast fake ydoc:user:left events

• UI disruption: Fake cursor positions and user presence in collaborative editing sessions
• User impersonation: Attacker can spoof any user_id in awareness updates
• Resource exhaustion: Unlimited unauthenticated WebSocket connections maintained by the server

Note: Other Ydoc handlers (ydoc:document:join, ydoc:document:update, ydoc:document:state) correctly check SESSION_POOL membership.

1. Set always_connect=False or reject unauthenticated connections in the connect handler
2. Add SESSION_POOL checks to ydoc:awareness:update and ydoc:document:leave
3. Add room membership verification before broadcasting to document rooms

AI Disclosure (per Rule 11): AI (Claude) was used to assist with source code review, identifying potential vulnerability patterns, and drafting this report. The researcher directed the analysis, selected focus areas, and independently verified all findings against a running v0.8.12 Docker instance using real HTTP requests with two test accounts. The PoCs included are reproducible and were confirmed live before submission.