CVE-2026-88005: Open WebUI OAuth token exchange authorization bypass

CVE-2026-88005 · Severity: medium · CVSS 6.5 · Published 2026-09-10

Open WebUI is a web interface for AI chat applications that supports OAuth login. A secondary token exchange endpoint was added to issue session credentials, but it bypasses the email domain allowlist that normally restricts access. This allows users whose email domains were explicitly blocked or removed from the allowlist to retain active sessions, circumventing administrative access controls.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-88005 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88005 being exploited in the wild.
How severe is CVE-2026-88005?
Medium severity, with a CVSS score of 6.5, published 10 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.8.0, < 0.9.0, ECOSYSTEM:introduced=0.8.0,fixed=0.9.0.
Is there a fix for CVE-2026-88005?
Yes. open-webui (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88005 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-88005?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.9.0 or later
    pip install "open-webui>=0.9.0"

Technical details

The vulnerability is an incorrect authorization check (CWE-863) in the OAuth token exchange endpoint located in `backend/open_webui/routers/auths.py`. The endpoint was introduced in version 0.8.0 as a second entry point to the session-issuing logic but re-implemented only the identity lookup without the policy checks present in the primary OAuth login callback. Specifically, it omits the domain allowlist verification that filters access based on the `OAUTH_ALLOWED_DOMAINS` configuration. An attacker can exploit this if: (1) `ENABLE_OAUTH_TOKEN_EXCHANGE` is enabled (disabled by default); (2) `OAUTH_ALLOWED_DOMAINS` is configured to restrict access (not set to wildcard); (3) they possess a valid, unexpired access token from the configured OAuth provider; and (4) their account already exists in Open WebUI, either linked to that provider or matching via email if `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` is enabled. The endpoint cannot create new accounts or elevate privileges, so it grants only continued access at the existing role. The fix in commit fb5ef978b (version 0.9.0) adds the domain allowlist check to the token exchange endpoint and returns HTTP 403 when the email domain is not allowed.

Affected products

  • Open WebUI open-webui >= 0.8.0, < 0.9.0

Identifiers

  • CVE-2026-88005
  • GHSA-4qg5-cxx4-g927
  • PYSEC-2026-4119

Timeline

  • 2026-08-29: disclosed
  • 2026-09-10: patched: Fix released in version 0.9.0 via commit fb5ef978b

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.