CVE-2024-12534: 
JavaScript vulnerability analysis and mitigation

CVE-2024-12534 affects version v0.3.32 of open-webui/open-webui, where the application lacks character length validation on email and password fields during the sign-in process. The vulnerability was discovered and disclosed on March 20, 2025 (NVD).

The vulnerability stems from insufficient input validation on the sign-in form fields. The application allows users to submit arbitrarily large payloads in both email and password fields without implementing proper length restrictions. The vulnerability has been assigned a CVSS v3.0 base score of 7.5 (HIGH) with a vector string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness has been classified as CWE-400 (Uncontrolled Resource Consumption) (NVD).

When exploited, this vulnerability can lead to a Denial of Service (DoS) condition. The submission of excessively large strings can exhaust server resources including CPU, memory, and disk space, ultimately rendering the service unavailable for legitimate users (NVD).

Users should upgrade to a version newer than v0.3.32 once available. In the meantime, implementing proper input validation and length restrictions on the email and password fields is recommended to prevent resource exhaustion attacks (NVD).