Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-70482
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- September 18, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which OAuth client the token was issued to. Anyone holding an access token minted for any client registered with the same provider could exchange it for an Open WebUI session as that token user, including applications the operator does not control and has never authorized. This issue is fixed in 0.11.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat program you host yourself that gives people a web page for talking to AI models. This flaw affects versions 0.8.0 up to but not including 0.11.0, and only when the optional feature that swaps a sign-in pass from an outside login service for an Open WebUI session is turned on. Anyone holding a sign-in pass issued by that same login service to any other app, even one your organization does not control, could use it to get into Open WebUI as that person. This flaw is rated High.
What to do
- Find out who installed or runs Open WebUI for your organization. It may be a staff member, a volunteer, or an outside IT provider.
- If that person is in your organization, ask them to check which version is running. Versions 0.8.0 up to but not including 0.11.0 are affected when the sign-in pass exchange feature is turned on.
- Have them update Open WebUI to version
0.11.0, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update to
0.11.0will be done.
Analysis written from the source record as of September 18, 2026 and reviewed before publishing.