Executive brief
Open WebUI is a web interface for AI chat applications that supports OAuth login. A secondary token exchange endpoint was added to issue session credentials, but it bypasses the email domain allowlist that normally restricts access. This allows users whose email domains were explicitly blocked or removed from the allowlist to retain active sessions, circumventing administrative access controls.
Technical details
The vulnerability is an incorrect authorization check (CWE-863) in the OAuth token exchange endpoint located in `backend/open_webui/routers/auths.py`. The endpoint was introduced in version 0.8.0 as a second entry point to the session-issuing logic but re-implemented only the identity lookup without the policy checks present in the primary OAuth login callback. Specifically, it omits the domain allowlist verification that filters access based on the `OAUTH_ALLOWED_DOMAINS` configuration. An attacker can exploit this if: (1) `ENABLE_OAUTH_TOKEN_EXCHANGE` is enabled (disabled by default); (2) `OAUTH_ALLOWED_DOMAINS` is configured to restrict access (not set to wildcard); (3) they possess a valid, unexpired access token from the configured OAuth provider; and (4) their account already exists in Open WebUI, either linked to that provider or matching via email if `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` is enabled. The endpoint cannot create new accounts or elevate privileges, so it grants only continued access at the existing role. The fix in commit fb5ef978b (version 0.9.0) adds the domain allowlist check to the token exchange endpoint and returns HTTP 403 when the email domain is not allowed.
Affected products
- Open WebUI open-webui >= 0.8.0, < 0.9.0
Timeline
- 2026-08-29: disclosed
- 2026-09-10: patched: Fix released in version 0.9.0 via commit fb5ef978b