CVE-2026-109283 open-webui CVE debrief

Who should care

Defenders and administrators of Open WebUI instances, particularly those using OAuth for authentication, should assess their exposure to this vulnerability and prioritize verification and remediation efforts.

Why it matters

The authorization bypass vulnerability in Open WebUI versions 0.11.1 before 0.11.4 poses a risk to defenders and administrators, particularly those using OAuth for authentication, as it could lead to unauthorized access or privilege escalation. Verification and remediation efforts should be prioritized.

• Potential unauthorized access to sensitive information or systems due to the authorization bypass vulnerability
• Possible privilege escalation for users with linked accounts whose identity provider role no longer satisfies the OAuth role policy
• Need for verification of OAuth role policies and role claims handling to prevent exploitation
• Priority for upgrading to Open WebUI version 0.11.4 or later to address the vulnerability

Technical summary

The Open WebUI versions 0.11.1 before 0.11.4 contain an authorization bypass vulnerability in the OAuth token exchange endpoint. This vulnerability allows users with a linked account whose identity provider role no longer satisfies the OAuth role policy to obtain a session retaining their previous role by sending a valid provider access token to the POST /api/v1/auths/oauth/{provider}/token/exchange endpoint. The vulnerability reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Affected product deployments should be verified and upgraded to Open WebUI version 0.11.4 or later to address the issue.

Defensive priority

Defenders should prioritize verifying and upgrading to Open WebUI version 0.11.4 or later to address the authorization bypass vulnerability.

Recommended defensive actions

• Verify and upgrade to Open WebUI version 0.11.4 or later
• Review and update OAuth role policies to ensure proper role claims handling
• Monitor for suspicious activity on the OAuth token exchange endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in Open WebUI versions 0.11.1 before 0.11.4. The vulnerability is related to the OAuth token exchange endpoint and role claims handling.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.