Executive brief
Open WebUI is a web interface for AI chat that supports single sign-on (OAuth). When OAuth role-based access control is enabled, administrators expect users to lose access immediately when their provider roles no longer match the allowed list. A flaw in the token exchange endpoint bypasses this check, allowing users who should be denied to retain valid sessions indefinitely, including those who lost admin privileges at the provider.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the OAuth token exchange endpoint (`backend/open_webui/routers/auths.py`). The endpoint accepts a provider access token and issues a session for an existing user account, but fails to re-evaluate role membership against OAuth role policies. While the normal OAuth login callback enforces role checks (denying access if no allowed role matches, or demoting users to lower roles), the token exchange endpoint skips this entirely. An attacker with a valid, unexpired provider access token for an account that exists in Open WebUI can call this endpoint to obtain a session, even if the identity provider has since revoked the account's required roles. The endpoint cannot create new accounts or escalate privileges—it only grants continued access at the account's existing role. Exploitation requires: (1) ENABLE_OAUTH_TOKEN_EXCHANGE=True (disabled by default), (2) ENABLE_OAUTH_ROLE_MANAGEMENT=True with role restrictions configured (disabled by default), (3) a valid provider access token, and (4) an existing Open WebUI account linked to the token's subject. Fix released in version 0.11.1 (commit d799e81ed) applies the same role evaluation to token exchange requests as the login callback, denying the exchange with HTTP 403 when no allowed role matches.
Affected products
- Open WebUI Open WebUI 0.8.0 through 0.11.0
Timeline
- 2026-09-10: disclosed: Advisory published to GitHub Advisory Database
- 2026-09-10: patched: Fix released in Open WebUI v0.11.1 (commit d799e81ed)