CVE-2026-109283
5.4MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Authenticated users whose upstream identity provider roles were downgraded can bypass authorization to keep their previous, higher-privileged roles. They only need network access and a valid OAuth access token from their linked provider.
Root cause
The OAuth token exchange endpoint ignores roles in the ID token and falls back to keeping the user's existing local role when the provider's userinfo endpoint omits role claims.
Affected systems
Open WebUI 0.11.1 before 0.11.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade Open WebUI to version 0.11.4 or later. If upgrading immediately is not possible, disable the OAuth token exchange endpoint or revoke sessions and unlink affected user accounts manually.
$ pip install --upgrade open-webui>=0.11.4AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.