CVE-2026-88006: Open WebUI OAuth token exchange authorization bypass

CVE-2026-88006 · Severity: medium · CVSS 6.5 · Published 2026-09-10

Open WebUI is a web interface for AI chat that supports single sign-on (OAuth). When OAuth role-based access control is enabled, administrators expect users to lose access immediately when their provider roles no longer match the allowed list. A flaw in the token exchange endpoint bypasses this check, allowing users who should be denied to retain valid sessions indefinitely, including those who lost admin privileges at the provider.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-88006 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88006 being exploited in the wild.
How severe is CVE-2026-88006?
Medium severity, with a CVSS score of 6.5, published 10 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.8.0, < 0.11.1, ECOSYSTEM:introduced=0.8.0,fixed=0.11.1.
Is there a fix for CVE-2026-88006?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88006 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-88006?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability is an authorization bypass (CWE-863) in the OAuth token exchange endpoint (`backend/open_webui/routers/auths.py`). The endpoint accepts a provider access token and issues a session for an existing user account, but fails to re-evaluate role membership against OAuth role policies. While the normal OAuth login callback enforces role checks (denying access if no allowed role matches, or demoting users to lower roles), the token exchange endpoint skips this entirely. An attacker with a valid, unexpired provider access token for an account that exists in Open WebUI can call this endpoint to obtain a session, even if the identity provider has since revoked the account's required roles. The endpoint cannot create new accounts or escalate privileges—it only grants continued access at the account's existing role. Exploitation requires: (1) ENABLE_OAUTH_TOKEN_EXCHANGE=True (disabled by default), (2) ENABLE_OAUTH_ROLE_MANAGEMENT=True with role restrictions configured (disabled by default), (3) a valid provider access token, and (4) an existing Open WebUI account linked to the token's subject. Fix released in version 0.11.1 (commit d799e81ed) applies the same role evaluation to token exchange requests as the login callback, denying the exchange with HTTP 403 when no allowed role matches.

Affected products

  • Open WebUI Open WebUI 0.8.0 through 0.11.0

Identifiers

  • CVE-2026-88006
  • GHSA-wvm9-9g5j-623f
  • PYSEC-2026-4129

Timeline

  • 2026-09-10: disclosed: Advisory published to GitHub Advisory Database
  • 2026-09-10: patched: Fix released in Open WebUI v0.11.1 (commit d799e81ed)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.