CVE-2026-88006: Incorrect Authorization in Open WebUI OAuth Token Exchange

Open WebUI is a self-hosted, extensible AI interface designed to orchestrate and serve large language models. To support enterprise-scale deployments, the application integrates OAuth and OpenID Connect (OIDC) protocols for decentralized user authentication. This architecture enforces access control policies by mapping central Identity Provider (IdP) groups and claims to local application roles, such as administrative or standard permissions.

The vulnerability designated as CVE-2026-88006 resides in the handling of the OAuth token exchange mechanism within versions 0.8.0 through 0.11.1. Specifically, the application implements two distinct flows to authenticate users via OAuth: an interactive browser-based callback flow and a direct token exchange API endpoint. The /token/exchange endpoint allows clients to obtain native session tokens by presenting a valid IdP access token directly to the backend.

This API endpoint failed to perform the necessary authorization and role mapping updates that occur during the standard interactive login process. Consequently, the application trusted stale local database records to establish user privileges. This flaw constitutes an incorrect authorization vulnerability classifiable under CWE-863, leading to potential privilege escalation or unauthorized persistence.

The core authorization failure stems from a design asymmetry between the interactive OAuth callback handler (handle_callback) and the API-driven token exchange handler (token_exchange). When a user logs in interactively, the handle_callback routine retrieves the latest user claims from the configured IdP. It then processes role definitions dynamically by comparing the user's IdP groups against configured environment variables such as OAUTH_ALLOWED_ROLES and OAUTH_ADMIN_ROLES.

In contrast, the pre-patch implementation of the token_exchange API endpoint in backend/open_webui/routers/auths.py omitted these evaluation passes. Upon receiving a valid provider access token, the system resolved the user entry in the local database and immediately issued a session token. No calls were made to execute the role update and user synchronization routines.

As a result, if an administrator modified a user's permissions on the Identity Provider—such as demoting an administrative account to a standard user or removing them from the allowed user list—the change was never propagated through the token exchange route. The affected user could bypass administrative revocation. By directly calling the /token/exchange endpoint with their IdP token, they could obtain an active session with their cached local roles, retaining full administrative access.

To understand the vulnerability, analyze the logic flow of the pre-patch token exchange routine. The endpoint verified the validity of the incoming OAuth token and checked for the existence of the corresponding database user. Once found, it returned the session immediately, skipping the entire block of synchronization functions.

The remediation introduced in commit d799e81edbdc971c6deb096b6474cd95b93504bf modularized the synchronization code block. The patch extracted user role updates, name updates, email updates, and picture updates from handle_callback in backend/open_webui/utils/oauth.py into a unified method named update_user_from_oauth. This method verifies if the user's role has changed based on incoming IdP claims and updates the database records accordingly.

The endpoint in backend/open_webui/routers/auths.py was subsequently updated to invoke update_user_from_oauth and update_user_groups before calling create_session_response. This ensures that every entry point that translates an external OAuth identity into an internal session executes identical authorization validations. The logic now prevents the reuse of stale permissions.

Exploitation of CVE-2026-88006 does not require sophisticated techniques, but relies on a specific sequence of administrative actions on the external Identity Provider. The primary prerequisite is that a target user must have previously logged into the Open WebUI instance with elevated permissions (such as the admin role). Following this initial login, the user's role is cached in the local database.

If the enterprise administrator subsequently revokes the user's administrative privileges or removes them from the allowed group on the central IdP, the restriction should take immediate effect. However, a malicious actor possessing the active provider access token can bypass this revocation. Instead of using the standard web login interface, the attacker sends a structured HTTP POST request directly to the /token/exchange endpoint of the Open WebUI instance.

The payload contains the valid IdP access token. Because the endpoint does not run the role synchronization logic, it matches the token to the database user and issues a JSON Web Token (JWT) matching the user's cached database state. The attacker receives an active session possessing administrative privileges, effectively escalating their access beyond the limits defined by the Identity Provider.

The technical impact of this vulnerability is assessed as Medium, with a CVSS v3.1 base score of 6.5. This classification reflects a partial authorization bypass rather than an unauthenticated remote code execution flaw. The attack vector is Network, and the complexity is Low, as no user interaction is required to trigger the incorrect authorization behavior.

The confidentiality and integrity impacts are both rated as Low because the scope of the exploit is limited to the permissions previously held by the target user. An attacker cannot escalate their privileges to a state they never possessed unless they manipulate the IdP configuration directly. However, in enterprise environments where accounts are systematically decommissioned or demoted, the persistence of administrative capabilities constitutes a significant risk.

Moreover, the failure to synchronize group mappings means that data governance policies mapped to user groups are not enforced. Unauthorized users may retain access to sensitive corporate knowledge bases, proprietary AI models, and administrative panels. This compromises the integrity of the local authorization boundary.

The primary mitigation for this vulnerability is upgrading the Open WebUI installation to version 0.11.1 or higher. The patch correctly integrates the synchronization routine into the token exchange endpoint, closing the authorization gap. Administrators can download the patched release from the official GitHub repository.

For deployments where immediate upgrading is not feasible, administrators should audit local user roles manually. This involves comparing the list of active administrators in the Open WebUI database against the current group memberships defined in the enterprise OIDC provider. Any accounts that show discrepancies must be corrected manually via the administrative panel.

Additionally, organizations should configure short expiration times (Time-To-Live) for access tokens issued by their Identity Providers. Because Open WebUI only validates the token during the initial exchange, limiting the lifetime of the IdP-issued token reduces the window of opportunity for an attacker to leverage an active token against the vulnerable endpoint.