Authorization Bypass in Open WebUI by Vendor Open WebUI

CVE-2026-109283

What is CVE-2026-109283?

Open WebUI versions prior to 0.11.4 exhibit a security flaw allowing an authorization bypass through the OAuth token exchange endpoint. This vulnerability occurs when the system reads role claims solely from the identity provider's userinfo response, failing to recognize roles provided in the ID token. Consequently, users with an associated account can exploit this issue to retain their previous roles even when their current identity provider roles do not comply with the established OAuth role policy. This enables unauthorized access to resources that should be restricted, posing a significant risk to the application and its users.

References