Incorrect authorization in Open WebUI - #VU146339
Published: August 31, 2026
Vulnerability details
The vulnerability allows a remote attacker to retain unauthorized access to the application.
The vulnerability exists due to improper access control in the OAuth token exchange endpoint in backend/open_webui/routers/auths.py when exchanging a provider access token for a session. A remote attacker can present a valid provider access token for an existing linked account to obtain a working session and retain unauthorized access to the application.
The issue affects deployments only when ENABLE_OAUTH_TOKEN_EXCHANGE is enabled and the skipped domain or role controls are in use. The endpoint does not create new accounts, and exploitation requires a valid unexpired provider access token for an existing account or a matching email when account merging by email is enabled.