CVE-2026-88006
Received Received - Intake

OAuth Session Bypass in Open WebUI

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88006
EUVD
EUVD-2026-75541

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open_webui open_webui From 0.8.0 (inc) to 0.11.1 (exc)
open_webui open_webui 0.11.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Open WebUI allows users to bypass OAuth role restrictions by using the token exchange endpoint. Normally, the login callback enforces role policies, but the token exchange endpoint did not apply these checks. Users who should have been denied or demoted could still gain access if they had an existing account or matching email.

Detection Guidance

To detect this vulnerability, check if your Open WebUI instance is running a vulnerable version (0.8.0 to 0.11.0). Verify if the OAuth token exchange endpoint is enabled by inspecting configuration files for ENABLE_OAUTH_TOKEN_EXCHANGE and ENABLE_OAUTH_ROLE_MANAGEMENT settings. Review access logs for unusual session creation via token exchange endpoints.

Impact Analysis

Unauthorized users may gain continued access to the system despite role restrictions. This could lead to data exposure, unauthorized actions, or privilege escalation if attackers exploit the bypass to maintain access.

Compliance Impact

This vulnerability could potentially affect compliance with standards like GDPR and HIPAA by allowing unauthorized access to user sessions. If users who should be restricted or demoted gain access through the OAuth token exchange endpoint, it may violate access control requirements in these regulations. The issue undermines role-based access controls, which are critical for maintaining confidentiality and integrity of sensitive data.

Mitigation Strategies

Immediately upgrade Open WebUI to version 0.11.1 or later. Disable the OAuth token exchange endpoint if not required by setting ENABLE_OAUTH_TOKEN_EXCHANGE to false. Review and enforce role management policies to ensure only authorized users retain access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart