Executive brief
Open WebUI is a user interface for interacting with AI models. A security flaw in its optional OAuth token exchange feature allows an attacker to take over a user's account, including administrator accounts, if the victim signs into a different, unrelated application using the same login provider (like Google or GitHub). This could lead to unauthorized access to private chats, sensitive data, and full control over the Open WebUI instance.
Technical details
The OAuth token exchange endpoint (`POST /api/v1/auths/oauth/{provider}/token/exchange`) in Open WebUI validates raw provider access tokens by calling the provider's userinfo endpoint but fails to perform audience or client ID validation. Because many OAuth providers (Google, GitHub, Okta) issue stable subject identifiers across different clients, an attacker can obtain a victim's token via a separate malicious or unrelated application and exchange it for a valid Open WebUI session. This vulnerability requires `ENABLE_OAUTH_TOKEN_EXCHANGE` to be set to True. The fix in version 0.11.0 introduces RFC 7662 token introspection to verify the `client_id`, though this requires manual configuration of `OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS`.
Affected products
- Open WebUI open-webui >= 0.8.0, < 0.11.0
Timeline
- 2026-08-02: disclosed
- 2026-08-02: patched: Fixed in version 0.11.0
- 2026-08-04: advisory