CVE-2026-109283 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Open WebUI versions prior to 0.11.4 represents a critical authorization bypass within the OAuth authentication flow, specifically targeting the token exchange endpoint located at POST /api/v1/auths/oauth/{provider}/token/exchange. This flaw stems from an inconsistent implementation of role claim validation during the user identity verification process. When a user authenticates via an external Identity Provider using OAuth 2.0 or OpenID Connect protocols, the application is responsible for mapping provider-specific roles to internal application permissions. However, in this affected version, the software exhibits a logic error where it exclusively reads role claims from the userinfo response endpoint while disregarding equivalent information present in the ID token. This selective parsing creates a significant gap in security controls, allowing attackers to manipulate the authentication outcome by exploiting discrepancies between these two data sources.
The technical mechanism of the exploit relies on the behavior observed when no roles claim is found within the userinfo response. In such scenarios, rather than defaulting to a restrictive or unauthenticated state, the application retains the user's existing role from their previous session or linked account context. This design decision assumes that if explicit new role information is absent in the primary identity payload, the prior authorization status remains valid and appropriate for the current login attempt. Consequently, an attacker who possesses a valid access token from an external provider can initiate a token exchange request even when the userinfo response lacks specific role definitions. By doing so, they successfully obtain a session that preserves their previous elevated privileges, effectively bypassing any intended restrictions imposed by the identity provider's updated or differing role policies.
From a security architecture perspective, this flaw aligns with CWE-285, which describes Improper Authorization, and specifically relates to issues where access control decisions are not consistently applied across all authentication vectors. The vulnerability also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it allows an adversary to maintain persistent valid credentials with unintended privileges. Furthermore, the exploitation of token exchange mechanisms falls under T1621, Token Manipulation, where attackers abuse trust relationships between services to escalate permissions. The core issue is a failure in state management and claim validation consistency, which undermines the principle of least privilege by allowing role inheritance that was not explicitly authorized for the current authentication context.
The operational impact of this vulnerability is severe, particularly in multi-tenant or enterprise environments where users may switch identity providers or where provider configurations change over time. An attacker with a compromised account on an external service could leverage their existing session data to retain administrative or high-level access within Open WebUI even after the identity provider revokes those permissions or changes its policy structure. This persistence of privilege can lead to unauthorized access to sensitive conversations, model configurations, and system settings. Additionally, because the vulnerability affects the token exchange endpoint used for establishing new sessions, it facilitates lateral movement if an attacker gains control over a lower-privileged account that has previously held higher privileges elsewhere in the ecosystem.
To mitigate this risk, organizations running Open WebUI must immediately upgrade to version 0.11.4 or later, where the role claim validation logic has been corrected to consistently check both the userinfo response and the ID token for role information. Until an update is applied, administrators should enforce strict network-level controls on the authentication endpoints and monitor for anomalous session creation patterns that do not align with expected identity provider claims. It is also advisable to review user roles regularly and ensure that any linked accounts are audited against current organizational security policies. Implementing additional logging around token exchange events can help detect attempts to exploit this bypass by tracking discrepancies between claimed roles in different parts of the OAuth flow versus the resulting session permissions.