CVE-2026-70482

Open WebUI can exchange a token issued to the wrong OAuth client

Open WebUI · Open WebUI OAuth token exchange

First documented disclosure · Review checkpoint

Summary

A token obtained through an unrelated OAuth application can be exchanged for a session as an existing Open WebUI user.

Severity and exploitation evidence

High · 8.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The advisory records a controlled sign-in as a test victim using a token minted for a foreign client. It does not establish malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The endpoint checked that the provider recognized the token but did not verify the client to which it had been issued.

Conditions required

Token exchange is enabled, the attacker obtains the user’s token for a different client of the same provider, and the identity matches an existing Open WebUI account.

Potential impact

The resulting session inherits the account’s role, including administrator permissions when an administrator is impersonated.

Affected versions and configurations

0.8.0 through versions before 0.11.0 with token exchange enabled. The feature is off by default.

Fix and mitigation status

0.11.0 adds client-ID checking. It requires a configured trusted-client list and provider introspection. An empty list leaves the old exchange behavior.

Practical next steps

Leave exchange disabled for providers without supported introspection. Otherwise upgrade, configure OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS and verify that a foreign-client token is rejected.

Operating lesson

Token validity and account identity do not establish which OAuth client received the token.

Evidence and limits

The public July 26 fix proposal precedes the July 27 release, August 2 advisory and August 4 CVE. The maintainer says Google, GitHub, Microsoft Entra ID and Feishu do not support the required introspection for this use.

Sources