Improper Authentication in Open WebUI - #VU140747
Published: August 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to take over another user's account.
The vulnerability exists due to improper authentication in the OAuth token exchange endpoint when validating provider access tokens through the userinfo endpoint without verifying the issuing client. A remote attacker can obtain a provider access token issued to another OAuth client and exchange it for an Open WebUI session to take over another user's account.
The issue affects deployments only when ENABLE_OAUTH_TOKEN_EXCHANGE=True. User interaction is required for the victim to sign in to an unrelated OAuth application so the attacker can obtain the victim's provider access token. The endpoint does not create users, so the target must already have an account.