UnratedFix available

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Type: advisorySource: OSV2 source records

## Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. ## Preconditions - `ENABLE_OAUTH_TOKEN_EXCHANGE=True`. It is disabled by default, so a default deployment is not affected. - `ENABLE_OAUTH_ROLE_MANAGEMENT=True` together with `OAUTH_ALLOWED_ROLES` or `OAUTH_ADMIN_ROLES`. Role management is off by default, and deployments not using it are not affected. - A valid, unexpired access token on the configured provider. - An Open WebUI account already linked to that provider subject, or an account with a matching email when `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` is enabled. This endpoint never creates accounts, so a token for a subject with no existing account is rejected. ## Impact An admin who relies on OAuth role management expects a user to lose access, or lose admin, as soon as the identity provider stops reporting the required role. The login callback does enforce this on the next sign-in. Token exchange kept issuing sessions and never re-evaluated the role, so the user retained working access as their existing account at its existing role, including an admin role the provider had already revoked. The endpoint cannot create an account and cannot raise anyone's role, so this grants continued acces

Announced 10 Sept 2026Group revision 1

Original source ↗

PYSEC-2026-4129

Revision 1

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

## Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. ## Preconditions - `ENABLE_OAUTH_TOKEN_EXCHANGE=True`. It is disabled by default, so a default deployment is not affected. - `ENABLE_OAUTH_ROLE_MANAGEMENT=True` together with `OAUTH_ALLOWED_ROLES` or `OAUTH_ADMIN_ROLES`. Role management is off by default, and deployments not using it are not affected. - A valid, unexpired access token on the configured provider. - An Open WebUI account already linked to that provider subject, or an account with a matching email when `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` is enabled. This endpoint never creates accounts, so a token for a subject with no existing account is rejected. ## Impact An admin who relies on OAuth role management expects a user to lose access, or lose admin, as soon as the identity provider stops reporting the required role. The login callback does enforce this on the next sign-in. Token exchange kept issuing sessions and never re-evaluated the role, so the user retained working access as their existing account at its existing role, including an admin role the provider had already revoked. The endpoint cannot create an account and cannot raise anyone's role, so this grants continued acces

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:PYSEC-2026-4129

open-webui

Source reference: /affected/0/package/name

Affected versions: 0.10.0
Source reference: /affected/0/versions
0.10.1
Source reference: /affected/0/versions
0.10.2
Source reference: /affected/0/versions
0.11.0
Source reference: /affected/0/versions
0.8.0
Source reference: /affected/0/versions
0.8.1
Source reference: /affected/0/versions
0.8.10
Source reference: /affected/0/versions
0.8.11
Source reference: /affected/0/versions
0.8.12
Source reference: /affected/0/versions
0.8.2
Source reference: /affected/0/versions
0.8.3
Source reference: /affected/0/versions
0.8.4
Source reference: /affected/0/versions
0.8.5
Source reference: /affected/0/versions
0.8.6
Source reference: /affected/0/versions
0.8.7
Source reference: /affected/0/versions
0.8.8
Source reference: /affected/0/versions
0.8.9
Source reference: /affected/0/versions
0.9.0
Source reference: /affected/0/versions
0.9.1
Source reference: /affected/0/versions
0.9.2
Source reference: /affected/0/versions
0.9.3
Source reference: /affected/0/versions
0.9.4
Source reference: /affected/0/versions
0.9.5
Source reference: /affected/0/versions
0.9.6
Source reference: /affected/0/versions
Fixed versions: 0.11.1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0.8.0"
          },
          {
            "fixed": "0.11.1"
          }
        ]
      }
    ],
    "package": {
      "name": "open-webui",
      "purl": "pkg:pypi/open-webui",
      "ecosystem": "PyPI"
    },
    "versions": [
      "0.10.0",
      "0.10.1",
      "0.10.2",
      "0.11.0",
      "0.8.0",
      "0.8.1",
      "0.8.10",
      "0.8.11",
      "0.8.12",
      "0.8.2",
      "0.8.3",
      "0.8.4",
      "0.8.5",
      "0.8.6",
      "0.8.7",
      "0.8.8",
      "0.8.9",
      "0.9.0",
      "0.9.1",
      "0.9.2",
      "0.9.3",
      "0.9.4",
      "0.9.5",
      "0.9.6"
    ],
    "database_specific": {
      "source": "https://github.com/pypa/advisory-database/blob/main/vulns/open-webui/PYSEC-2026-4129.yaml"
    }
  }
]

Related CVEs: CVE-2026-88006
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event: #62504 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 19:26:34 GMT
Publisher date: Thu, 01 Oct 2026 16:38:30 GMT

Read the original announcement

GHSA-wvm9-9g5j-623f

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-wvm9-9g5j-623f

open-webui

Source reference: /affected/0/package/name

Affected versions: 0.10.0
Source reference: /affected/0/versions
0.10.1
Source reference: /affected/0/versions
0.10.2
Source reference: /affected/0/versions
0.11.0
Source reference: /affected/0/versions
0.8.0
Source reference: /affected/0/versions
0.8.1
Source reference: /affected/0/versions
0.8.10
Source reference: /affected/0/versions
0.8.11
Source reference: /affected/0/versions
0.8.12
Source reference: /affected/0/versions
0.8.2
Source reference: /affected/0/versions
0.8.3
Source reference: /affected/0/versions
0.8.4
Source reference: /affected/0/versions
0.8.5
Source reference: /affected/0/versions
0.8.6
Source reference: /affected/0/versions
0.8.7
Source reference: /affected/0/versions
0.8.8
Source reference: /affected/0/versions
0.8.9
Source reference: /affected/0/versions
0.9.0
Source reference: /affected/0/versions
0.9.1
Source reference: /affected/0/versions
0.9.2
Source reference: /affected/0/versions
0.9.3
Source reference: /affected/0/versions
0.9.4
Source reference: /affected/0/versions
0.9.5
Source reference: /affected/0/versions
0.9.6
Source reference: /affected/0/versions
Fixed versions: 0.11.1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0.8.0"
          },
          {
            "fixed": "0.11.1"
          }
        ]
      }
    ],
    "package": {
      "name": "open-webui",
      "purl": "pkg:pypi/open-webui",
      "ecosystem": "PyPI"
    },
    "versions": [
      "0.10.0",
      "0.10.1",
      "0.10.2",
      "0.11.0",
      "0.8.0",
      "0.8.1",
      "0.8.10",
      "0.8.11",
      "0.8.12",
      "0.8.2",
      "0.8.3",
      "0.8.4",
      "0.8.5",
      "0.8.6",
      "0.8.7",
      "0.8.8",
      "0.8.9",
      "0.9.0",
      "0.9.1",
      "0.9.2",
      "0.9.3",
      "0.9.4",
      "0.9.5",
      "0.9.6"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wvm9-9g5j-623f/GHSA-wvm9-9g5j-623f.json"
    }
  }
]

Related CVEs: CVE-2026-88006
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event: #62561 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 19:28:29 GMT
Publisher date: Thu, 10 Sep 2026 23:04:57 GMT

Read the original announcement

Revision history