Authorization Bypass in Open WebUI OAuth Exchange

Executive Summary

Open WebUI versions 0.11.1 to 0.11.3 have an authorization bypass in the OAuth token exchange endpoint. The system only reads role claims from the userinfo response and ignores roles in the ID token. If a user's role is revoked but roles are only sent in the ID token, they can still obtain a session with their previous role by exchanging a valid access token.

Useful 0 Not Useful 0

Detection Guidance

Check Open WebUI version with: curl -s http://localhost:8080/api/version | grep version. If running 0.11.1 to 0.11.3, the system is vulnerable. Monitor logs for POST requests to /api/v1/auths/oauth/{provider}/token/exchange from users whose roles were revoked.

Useful 0 Not Useful 0

Impact Analysis

Users with revoked roles could regain unauthorized access to resources they no longer qualify for. This requires specific configurations: OAuth token exchange and role management must be enabled, and roles must be sent only in the ID token. Browser-based login blocks such users, but token exchange does not.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data. If a user's role is revoked but they can still gain access via the OAuth token exchange flaw, it may violate access control requirements in these regulations. However, the vulnerability requires specific configurations and previously provisioned accounts, limiting its scope.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later immediately. Disable ENABLE_OAUTH_TOKEN_EXCHANGE and ENABLE_OAUTH_ROLE_MANAGEMENT if not required. Review and revoke access for users with linked accounts whose roles no longer meet policy requirements.

Useful 0 Not Useful 0