CVE-2026-88006 in Open WebUI
Summary
by MITRE • 09/10/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within Open WebUI versions ranging from 0.8.0 to 0.11.1 represents a critical authentication bypass flaw rooted in the application's OAuth integration logic. Open WebUI serves as an extensible, self-hosted platform for artificial intelligence interactions, relying heavily on external identity providers via the OAuth protocol to manage user access and session creation. The core of this security failure lies in the disparity between two distinct code paths used during authentication: the standard login callback endpoint and a separate token exchange endpoint designed for handling provider access tokens. While both endpoints are intended to establish user sessions, they do not enforce identical authorization checks, creating an inconsistency that attackers can exploit to bypass role-based restrictions.
In a properly secured OAuth implementation, when a user authenticates through an external identity provider, the application must validate not only the authenticity of the token but also map the received roles and permissions against its internal access control policies. The standard login callback endpoint in Open WebUI correctly implements this logic by running comprehensive role management procedures. This process ensures that if a user's assigned roles from the identity provider violate organizational policy or exceed permitted privileges, the system will either refuse authentication entirely or demote the user to an appropriate, lower-privilege level before issuing a session cookie. However, the token exchange endpoint bypasses this crucial validation step. It accepts the access token and immediately issues a valid session based on the roles present in that token without performing the necessary role management checks.
This architectural inconsistency allows for privilege escalation attacks where users with restricted or denied roles can circumvent these controls simply by utilizing the alternative authentication path. An attacker who has been explicitly denied access or demoted to a lower tier through the standard login flow could instead authenticate via the vulnerable endpoint, thereby obtaining a fully functional session at their original, unauthorized role level. This effectively nullifies the intended security boundaries established by administrators and identity providers, granting users permissions they should not possess. The impact is particularly severe in multi-tenant or enterprise environments where strict adherence to least privilege principles is required for data isolation and operational integrity.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, specifically regarding the failure to enforce proper authorization checks during session establishment. It also relates to CWE-613, Insufficient Session Expiration, insofar as it allows unauthorized sessions to persist based on flawed token handling logic. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates Initial Access and Privilege Escalation techniques, allowing adversaries to bypass existing controls to gain higher-level access within the application environment. The lack of consistent validation across different authentication endpoints is a common pitfall in complex web applications that integrate multiple identity providers or support various OAuth flows without uniform security policies.
To mitigate this vulnerability, organizations running Open WebUI must upgrade immediately to version 0.11.1 or later, where the token exchange endpoint has been patched to enforce the same role management logic as the standard login callback. Until an upgrade is feasible, administrators should consider restricting network access to the vulnerable endpoints if possible and closely monitoring for anomalous session creation patterns that may indicate exploitation attempts. Furthermore, this incident highlights the importance of conducting thorough code reviews on all authentication-related endpoints in web applications to ensure consistent enforcement of security policies across every path a user might take to authenticate. Regular penetration testing focused on authorization bypasses can help identify similar inconsistencies before they are exploited by malicious actors.