OAuth Token Exchange Flaw in Open WebUI by Open WebUI

CVE-2026-88005

What is CVE-2026-88005?

Open WebUI, an extensible self-hosted AI platform, has a vulnerability residing in its OAuth token exchange endpoint. Between versions 0.8.0 and 0.9.0, the platform's implementation failed to enforce the email domain allowlist during the token exchange process. This oversight means that accounts with email domains that would typically be restricted could still gain access to a valid session. The issue was rectified in version 0.9.0, which restored proper domain checks to enhance security.

References