CVE-2026-109283

MEDIUM 5.4

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.

CWE	CWE-863
Vendor	open-webui
Product	open-webui
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for open-webui open-webui

Be the first to know when new medium vulnerabilities affecting open-webui open-webui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

open-webui / open-webui

0.11.1 < 0.11.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/open-webui/open-webui/security/advisories/GHSA-2rr4-q6pg-m5g3 vulncheck.com: https://www.vulncheck.com/advisories/open-webui-0.11.1-before-0.11.4-authorization-bypass-via-oauth-token-exchange

Credits

🔍 manus-pi Classic298 🔍 manus-use