CVE-2026-88005: 
Python vulnerability analysis and mitigation

CVE-2026-88005 is an incorrect authorization vulnerability in Open WebUI's OAuth token exchange endpoint that allows users outside the configured email domain allowlist to obtain valid sessions. Affecting Open WebUI versions >= 0.8.0 and < 0.9.0 (both pip and Docker distributions), the flaw was discovered by researcher @Classic298, privately disclosed on August 29, 2026, and publicly published to the GitHub Advisory Database on September 10, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause (CWE-863: Incorrect Authorization) lies in backend/open_webui/routers/auths.py, where the OAuth token exchange endpoint was introduced in version 0.8.0 as a second session-issuing path alongside the normal OAuth login callback. The callback enforced the OAUTH_ALLOWED_DOMAINS policy within its own body, but the token exchange endpoint re-implemented only the identity lookup step and omitted the domain allowlist check entirely — meaning the policy was never applied to this code path. An attacker with a valid, unexpired provider access token whose email domain is blocked by the allowlist can POST directly to the token exchange endpoint to receive a working session, bypassing the restriction the login callback would enforce (Github Advisory, Fix Commit).

Successful exploitation allows a user whose email domain has been removed from the OAUTH_ALLOWED_DOMAINS allowlist to retain persistent session access to the Open WebUI instance at their existing role level. The endpoint cannot create new accounts or escalate privileges, so the impact is limited to continued unauthorized access rather than initial compromise or privilege escalation. Confidentiality and integrity are both assessed as low impact, with no availability impact, as the attacker can interact with AI platform features accessible to their pre-existing account role (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.0, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a specific non-default configuration: ENABLE_OAUTH_TOKEN_EXCHANGE=True must be set, OAUTH_ALLOWED_DOMAINS must be restricted to specific domains, and the attacker must already possess a valid provider access token and a pre-existing Open WebUI account linked to that provider (Github Advisory, Feedly).

1. Identify a target instance: Locate an Open WebUI deployment (>= 0.8.0, < 0.9.0) that has ENABLE_OAUTH_TOKEN_EXCHANGE=True and OAUTH_ALLOWED_DOMAINS configured to restrict access to specific domains.
2. Obtain a valid provider access token: Authenticate with the configured OAuth provider (e.g., Google, GitHub) using an account whose email domain is not in the allowlist but has a pre-existing Open WebUI account linked to that provider subject.
3. Send a token exchange request: POST the valid provider access token directly to the Open WebUI OAuth token exchange endpoint (in backend/open_webui/routers/auths.py), bypassing the normal OAuth login callback flow.
4. Receive a session: The endpoint performs identity lookup and issues a session without checking the domain allowlist, returning a valid session token for the blocked account.
5. Access the platform: Use the issued session to interact with Open WebUI at the account's existing role level, circumventing the admin's domain restriction policy (Github Advisory, Fix PR).

• Logs: Open WebUI application logs showing successful token exchange responses (HTTP 200) for accounts with email domains not present in OAUTH_ALLOWED_DOMAINS; absence of the warning log message Token exchange denied: email domain not in allowed domains list for such accounts on versions prior to 0.9.0.
• Network: Unexpected POST requests to the OAuth token exchange endpoint from IP addresses or user agents inconsistent with normal user activity, particularly from accounts whose domains were recently removed from the allowlist.
• Application: Active sessions belonging to user accounts with email domains outside the configured OAUTH_ALLOWED_DOMAINS list on affected Open WebUI versions (Github Advisory).

Upgrade Open WebUI to version 0.9.0 or later, which includes fix commit fb5ef97 that adds the same OAUTH_ALLOWED_DOMAINS check to the token exchange endpoint, returning HTTP 403 for disallowed domains. As an immediate workaround for deployments that cannot upgrade, set ENABLE_OAUTH_TOKEN_EXCHANGE=False (the default value) to disable the vulnerable endpoint entirely. Deployments where OAUTH_ALLOWED_DOMAINS is set to * (wildcard) or where token exchange is already disabled are not affected (Github Advisory, Fix Commit).