CVE-2026-109283: Open WebUI authorization bypass in OAuth token exchange

CVE-2026-109283 · Severity: medium · CVSS 5.4 · Published 2026-10-12

Open WebUI is a web application for managing AI model interactions. Users whose access was revoked by changing their role in the identity provider can still sign in if their company uses certain OAuth providers that only include role information in the ID token. An attacker with an existing linked account can retain their previous access level even after being locked out through role policy changes.

Technologies: Open WebUI. Vendors: Open WebUI.

Quick answers

Is CVE-2026-109283 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109283 being exploited in the wild.
How severe is CVE-2026-109283?
Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?
Open WebUI 0.11.1 to 0.11.3.
Is there a fix for CVE-2026-109283?
Yes: fixed in 0.11.4. Until then: Ensure ENABLE_OAUTH_TOKEN_EXCHANGE is set to false (the default) unless token exchange is explicitly required. If token exchange is enabled, verify that ENABLE_OAUTH_ROLE_MANAGEMENT is disabled or that your OAuth provider returns role claims in the userinfo response rather than only in the ID token. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109283 attacked?
It is attacked over the network.
Am I affected by CVE-2026-109283?
Check whether you run Open WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.11.4

Ensure ENABLE_OAUTH_TOKEN_EXCHANGE is set to false (the default) unless token exchange is explicitly required. If token exchange is enabled, verify that ENABLE_OAUTH_ROLE_MANAGEMENT is disabled or that your OAuth provider returns role claims in the userinfo response rather than only in the ID token.

Technical details

The OAuth token exchange endpoint fails to read role claims from the ID token that is part of the exchanged access token, instead reading only from the userinfo response. When no roles claim exists in userinfo and role management is enabled, the endpoint keeps the user's previous role instead of enforcing the OAuth role policy. This occurs when the identity provider (such as Microsoft Entra ID) sends roles only in the ID token; attackers with a previously provisioned account and valid provider access token can POST to /api/v1/auths/oauth/{provider}/token/exchange to obtain a session with their original role. The fix was released in version 0.11.4.

Affected products

  • Open WebUI Open WebUI 0.11.1 to 0.11.3

Timeline

  • 2026-09-27: disclosed: GitHub Security Advisory GHSA-2rr4-q6pg-m5g3 published
  • 2026-10-12: patched: Version 0.11.4 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.