CVE-2026-88006: CVE-2026-88006: Incorrect Authorization in Open WebUI OAuth Token Exchange

#security #cve #cybersecurity

CVE-2026-88006: Incorrect Authorization in Open WebUI OAuth Token Exchange

Vulnerability ID: CVE-2026-88006
CVSS Score: 6.5
Published: 2026-09-10

An incorrect authorization vulnerability in Open WebUI allows users to bypass Identity Provider (IdP) role revocations and demotions. Prior to version 0.11.1, the OAuth token exchange endpoint failed to execute user synchronization and group mapping checks, enabling users with active provider tokens to establish sessions with their cached, stale database roles.

TL;DR

Open WebUI's token exchange endpoint bypassed Identity Provider role checks, letting demoted or revoked users access the application with stale, cached database privileges.

Technical Details

CWE ID: CWE-863 (Incorrect Authorization)
Attack Vector: Network
CVSS v3.1 Score: 6.5
Impact: Partial Privilege Escalation / Authorization Bypass
Exploit Status: None/Unproven
CISA KEV Status: Not Listed

Affected Systems

Open WebUI
Open WebUI: >= 0.8.0, < 0.11.1 (Fixed in: 0.11.1)

Code Analysis

Commit: d799e81

Refactor user synchronization and integrate role check inside token exchange endpoint

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or higher.
Implement short-lived access tokens on the external Identity Provider.
Audit existing database roles periodically to align with the identity provider directory.

Remediation Steps:

Identify the running version of Open WebUI.
Download the v0.11.1 release or pull the updated Docker container image.
Deploy the updated application and restart the backend services.
Verify that requests to the /token/exchange endpoint trigger the role mapping checks.

References

Read the full report for CVE-2026-88006 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community