CVE-2026-88006: 
Python vulnerability analysis and mitigation

CVE-2026-88006 is an Incorrect Authorization vulnerability in Open WebUI's OAuth token exchange endpoint that allows users denied or demoted by OAuth role management policies to still obtain valid sessions at their existing privilege level. It affects Open WebUI versions >= 0.8.0 and < 0.11.1 (both pip and Docker distributions). The vulnerability was published on September 10, 2026, with the fix released in version 0.11.1. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Open WebUI Advisory).

The root cause (CWE-863: Incorrect Authorization) lies in the OAuth token exchange endpoint (backend/open_webui/routers/auths.py), introduced in version 0.8.0 as a second entry point into the session-issuing path. Unlike the normal OAuth login callback, this endpoint re-implemented only the identity lookup step and omitted the OAuth role management policy checks — because role evaluation logic resided inside the callback's own body rather than in shared code, the token exchange endpoint inherited none of it. Exploitation requires: ENABLE_OAUTH_TOKEN_EXCHANGE=True (disabled by default), ENABLE_OAUTH_ROLE_MANAGEMENT=True with OAUTH_ALLOWED_ROLES or OAUTH_ADMIN_ROLES configured, a valid unexpired provider access token, and an existing Open WebUI account linked to that provider subject. The endpoint cannot create new accounts or elevate roles beyond what the account already holds (Open WebUI Advisory, Fix Commit).

A user whose access should have been revoked or demoted by the identity provider can retain a working session — including admin-level access — by authenticating through the token exchange endpoint instead of the standard login callback. This means role revocations made at the identity provider level are not enforced until the user next authenticates via the normal OAuth flow, potentially allowing prolonged unauthorized access to AI platform features, conversation data, and administrative controls. The endpoint cannot grant new accounts or raise privileges beyond the user's existing role, so the impact is limited to persistence of access that should have been terminated (Open WebUI Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is only possible when both ENABLE_OAUTH_TOKEN_EXCHANGE and ENABLE_OAUTH_ROLE_MANAGEMENT are enabled — both are disabled by default — significantly limiting the exposed attack surface to intentionally configured deployments (Github Advisory).

1. Identify a target deployment: Confirm the Open WebUI instance is running version >= 0.8.0 and < 0.11.1 with both ENABLE_OAUTH_TOKEN_EXCHANGE=True and ENABLE_OAUTH_ROLE_MANAGEMENT=True configured.
2. Obtain a valid provider access token: Authenticate with the configured OAuth identity provider (e.g., via a browser or API call) to obtain a valid, unexpired access token for an account that has an existing Open WebUI session linked to that provider subject.
3. Confirm account linkage: Verify that the Open WebUI account is already linked to the provider subject (or that OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled and the email matches), since the endpoint does not create new accounts.
4. Submit token to the exchange endpoint: Send the provider access token directly to the OAuth token exchange endpoint in Open WebUI's backend (/auths/token-exchange or equivalent), bypassing the normal OAuth login callback flow.
5. Receive a valid session: The endpoint issues a session token without re-evaluating the user's current provider roles, granting continued access at the account's existing role — even if the identity provider has revoked the required role (Open WebUI Advisory).

• Logs: Authentication events in Open WebUI logs showing successful session creation via the OAuth token exchange endpoint (source='oauth', token exchange path) for users whose identity provider roles have been revoked or changed.
• Logs: Absence of USER_ROLE_UPDATED events for users who should have had their roles demoted following identity provider changes, combined with continued active sessions for those users.
• Network: API requests to the OAuth token exchange endpoint from users who are no longer authorized at the identity provider level, particularly after role revocation events at the IdP.
• Application Behavior: Admin-level actions performed by accounts whose corresponding identity provider roles have been removed, without a corresponding re-authentication event through the standard OAuth callback (Open WebUI Advisory).

Upgrade Open WebUI to version 0.11.1 or later, which applies the same role evaluation logic to the token exchange endpoint as the standard OAuth login callback (commit d799e81). After upgrading, no further configuration changes are required — the fix automatically enforces role checks and returns HTTP 403 when the provider's reported roles do not match any allowed or admin role. If immediate upgrading is not possible, disable the OAuth token exchange feature by setting ENABLE_OAUTH_TOKEN_EXCHANGE=False, or restrict network access to the token exchange endpoint (Open WebUI Advisory, v0.11.1 Release).

The vulnerability was discovered and reported by researcher @Classic298 and was published as a GitHub Security Advisory (GHSA-wvm9-9g5j-623f) by the Open WebUI maintainers. The advisory was rated Moderate severity, reflecting the non-default configuration requirements that limit the exposed population. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Open WebUI Advisory).