What’s Vulnerable › Vulnerabilities

CVE-2026-109283: Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-863

Description

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.

Affected products

• open-webui: from 0.11.1 before 0.11.4 — fixed in 0.11.4

How to fix

Upgrade to a fixed version: open-webui 0.11.4. Check the vendor advisory for mitigations.

References

• https://github.com/open-webui/open-webui/security/advisories/GHSA-2rr4-q6pg-m5g3
• https://www.vulncheck.com/advisories/open-webui-0.11.1-before-0.11.4-authorization-bypass-via-oauth-token-exchange
• https://github.com/open-webui/open-webui/security/advisories/GHSA-2rr4-q6pg-m5g3

Get alerted when CVE-2026-109283 or the next vulnerability affects your stack