CVE-2026-70482: Open WebUI Auth Bypass Vulnerability

CVE-2026-70482 Overview

CVE-2026-70482 is an authentication bypass vulnerability in Open WebUI, a self-hosted AI platform. The flaw affects versions 0.8.0 through versions prior to 0.11.0 when the ENABLE_OAUTH_TOKEN_EXCHANGE=True configuration is enabled. The /oauth/{provider}/token/exchange endpoint accepts a raw provider access token and validates it by calling the provider userinfo endpoint. The endpoint does not confirm which OAuth client the token was issued to. Any attacker holding an access token minted for any client registered with the same identity provider can exchange it for an authenticated Open WebUI session as that user. This includes tokens issued to third-party applications the operator has never authorized. The issue maps to [CWE-287] Improper Authentication and is fixed in version 0.11.0.

Critical Impact
Attackers holding an OAuth access token from any client registered under the same identity provider can impersonate legitimate users and hijack Open WebUI sessions, gaining full access to that user's AI workspace, conversations, and data.

Affected Products

Open WebUI versions 0.8.0 through 0.10.x
Deployments with ENABLE_OAUTH_TOKEN_EXCHANGE=True
Any Open WebUI instance sharing an OAuth provider with other client applications

Discovery Timeline

2026-08-04 - CVE-2026-70482 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-70482

Vulnerability Analysis

Open WebUI implements an OAuth token exchange flow that allows external clients to trade a provider-issued access token for an Open WebUI session. The exchange endpoint at /oauth/{provider}/token/exchange validates incoming tokens by calling the identity provider's userinfo endpoint. If the provider returns a valid user profile, Open WebUI mints a session for that user.

The validation logic omits a critical check. It never verifies the aud (audience) or client_id claim that identifies which OAuth client the token was minted for. Providers such as Google, Microsoft Entra ID, and Okta will happily return userinfo for any valid token they issued, regardless of which registered application requested it.

An attacker who obtains a token from an unrelated application registered under the same identity provider can present it to Open WebUI. The token passes userinfo validation and the attacker receives a session as the token's owner.

Root Cause

The root cause is missing token audience validation in the OAuth token exchange handler. The implementation trusts any token the provider recognizes without binding it to Open WebUI's own OAuth client identifier. This violates the OAuth 2.0 Token Exchange specification (RFC 8693), which requires validation of the requesting client and token audience.

Attack Vector

The attack requires network access to the Open WebUI instance and a valid access token issued by the same identity provider for any registered client. The attacker sends the token to /oauth/{provider}/token/exchange and receives an authenticated session. User interaction is required only in the sense that the victim must have previously authorized the malicious or unrelated application to obtain a token.

python

# Patch excerpt: backend/open_webui/env.py
# Introduces trusted client ID allowlist for token exchange
OAUTH_TOKEN_EXCHANGE_RATE_LIMIT_WINDOW = int(os.getenv('OAUTH_TOKEN_EXCHANGE_RATE_LIMIT_WINDOW', str(60 * 3)))
OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS = [
    client_id.strip()
    for client_id in os.getenv('OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS', '').split(',')
    if client_id.strip()
]

# Back-Channel Logout Configuration
# When enabled, exposes POST /oauth/backchannel-logout for IdP-initiated logout

Source: GitHub Commit c4332be7

The patch introduces the OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS environment variable. Only tokens minted for a client ID in this allowlist are accepted by the exchange endpoint.

Detection Methods for CVE-2026-70482

Indicators of Compromise

Unexpected POST requests to /oauth/{provider}/token/exchange from unfamiliar source IP ranges
Successful session creation events for users who did not initiate an interactive Open WebUI login
Access token exchange events where the identity provider's client ID does not match the Open WebUI registration
New Open WebUI sessions immediately followed by access to sensitive conversations or model configurations

Detection Strategies

Enable verbose logging on the /oauth/{provider}/token/exchange route and capture the presenting client ID from the userinfo response
Correlate identity provider audit logs with Open WebUI session creation events to identify audience mismatches
Alert on sessions created via token exchange where the source IP has no history for the associated user

Monitoring Recommendations

Forward Open WebUI application logs and identity provider audit logs to a centralized logging platform
Monitor for spikes in token exchange requests, which may indicate token replay from a compromised third-party client
Track new OAuth client registrations at the identity provider and reconcile against approved Open WebUI integrations

How to Mitigate CVE-2026-70482

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later
If upgrade is not immediately possible, set ENABLE_OAUTH_TOKEN_EXCHANGE=False to disable the vulnerable endpoint
Review identity provider logs for anomalous token exchange activity across affected versions
Rotate OAuth client secrets and revoke long-lived tokens issued to unrelated applications sharing the provider

Patch Information

The fix ships in Open WebUI 0.11.0. Review the GitHub Security Advisory GHSA-rq84-p6rr-vf89 for full details. The remediation adds an explicit OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS allowlist so operators must declare which OAuth client IDs may perform token exchange. See GitHub Commit b190dcf3 and GitHub Commit c4332be7 for the code-level changes, and the GitHub Release v0.11.0 notes.

Workarounds

Disable the token exchange feature by setting ENABLE_OAUTH_TOKEN_EXCHANGE=False until patching is complete
Restrict network access to /oauth/{provider}/token/exchange at the reverse proxy or web application firewall layer
Isolate the Open WebUI OAuth registration by using a dedicated identity provider tenant that does not host other client applications

bash

# Configuration example: disable token exchange until patched
export ENABLE_OAUTH_TOKEN_EXCHANGE=False

# After upgrading to 0.11.0, explicitly allowlist trusted OAuth client IDs
export ENABLE_OAUTH_TOKEN_EXCHANGE=True
export OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS="open-webui-client-id-1,open-webui-client-id-2"
export OAUTH_TOKEN_EXCHANGE_RATE_LIMIT_WINDOW=180