CVE-2026-109283 Overview
CVE-2026-109283 is an authorization bypass vulnerability in Open WebUI versions 0.11.1 through 0.11.3. The flaw resides in the OAuth token exchange endpoint, which reads role claims only from the identity provider's userinfo response. When no roles claim appears in that response, the endpoint retains the user's existing role, ignoring any role changes communicated through the ID token. Users with a linked account whose provider role no longer satisfies the OAuth role policy can submit a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange and obtain a session that keeps their prior role. This weakness is tracked under CWE-863: Incorrect Authorization.
Critical Impact
Users whose identity provider role was downgraded or revoked can retain their previous Open WebUI role, bypassing OAuth role policy enforcement.
Affected Products
- Open WebUI version 0.11.1
- Open WebUI version 0.11.2
- Open WebUI version 0.11.3
Discovery Timeline
- 2026-10-12 - CVE-2026-109283 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109283
Vulnerability Analysis
Open WebUI supports OAuth-based authentication where identity provider claims are mapped to internal roles. The token exchange endpoint accepts a provider access token and issues an Open WebUI session. Role evaluation during this exchange is incomplete, allowing stale role assignments to persist across sessions.
An authenticated user with a linked OAuth account can call POST /api/v1/auths/oauth/{provider}/token/exchange with a valid provider access token. The server queries the provider's userinfo endpoint and inspects the response for role claims. When no roles claim is present, the application falls back to the previously stored role instead of enforcing the configured OAuth role policy. Role claims delivered exclusively through the ID token are not consulted during this path.
Root Cause
The root cause is incorrect authorization logic in the token exchange handler. The handler treats a missing userinfo roles claim as "no change required" rather than as a signal to re-evaluate authorization against the configured policy. The ID token, which may legitimately carry role information in standards-compliant OpenID Connect deployments, is not consulted during token exchange role resolution.
Attack Vector
Exploitation requires an existing linked account and a valid provider access token. The attacker's provider role must have been reduced or removed by the identity provider administrator. The attacker then invokes the token exchange endpoint over the network. No elevated privileges and no user interaction are required to execute the request. The resulting session continues to carry the attacker's prior Open WebUI role.
No verified proof-of-concept code has been published. Technical details are available in the GitHub Security Advisory GHSA-2rr4-q6pg-m5g3 and the VulnCheck Advisory for Open WebUI.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109283
Indicators of Compromise
- Requests to POST /api/v1/auths/oauth/{provider}/token/exchange from accounts whose provider-side role was recently reduced or revoked.
- Open WebUI session audit entries showing elevated roles for users who no longer hold those roles at the identity provider.
- Discrepancies between identity provider role assignments and Open WebUI role assignments for OAuth-linked accounts.
Detection Strategies
- Correlate identity provider role change events with subsequent Open WebUI token exchange calls to flag mismatched sessions.
- Enable application-level logging on the OAuth token exchange endpoint and alert on exchanges that keep a prior administrative role.
- Perform periodic reconciliation between the Open WebUI user role table and the identity provider's authoritative role store.
Monitoring Recommendations
- Monitor Open WebUI server logs for repeated calls to /api/v1/auths/oauth/{provider}/token/exchange by the same account.
- Track administrative actions performed by OAuth-linked users and compare them against current provider role membership.
- Alert on access tokens being presented after a known provider-side role revocation within the token's remaining lifetime.
How to Mitigate CVE-2026-109283
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.4 or later on all affected deployments.
- Audit all OAuth-linked accounts and reconcile their current Open WebUI role against the identity provider's authoritative role.
- Revoke outstanding provider access tokens for users whose roles have been reduced or removed since the initial OAuth link.
- Force re-authentication for all OAuth users following the upgrade to invalidate stale sessions.
Patch Information
Open WebUI version 0.11.4 addresses CVE-2026-109283. Refer to the GitHub Security Advisory GHSA-2rr4-q6pg-m5g3 for the maintainer's remediation details and to the VulnCheck Advisory for Open WebUI for additional advisory context.
Workarounds
- Where upgrading is not immediately possible, disable the OAuth token exchange endpoint or restrict it at the reverse proxy layer.
- Manually downgrade or deactivate Open WebUI accounts whose provider-side roles no longer satisfy the OAuth role policy.
- Shorten OAuth access token lifetimes at the identity provider to reduce the window in which stale tokens can be exchanged.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
