EUVD-2026-75540
GHSA-4qg5-cxx4-g927
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects three non-default prerequisites (feature disabled by default, specific allowlist config, existing account with valid provider token); C:L/I:L because access is limited to existing account role.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this endpoint. This issue is fixed in version 0.9.0.
AnalysisAI
Open WebUI's OAuth token exchange endpoint (present in versions 0.8.0 through 0.8.x) bypasses the OAUTH_ALLOWED_DOMAINS email domain allowlist that the normal OAuth login callback enforces, allowing a user whose domain was removed from the allowlist to continue obtaining valid sessions via the alternate endpoint. The flaw is rooted in code duplication: the token exchange endpoint re-implemented identity lookup but omitted the authorization policy checks present in the primary callback. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all four of the following conditions simultaneously: (1) `ENABLE_OAUTH_TOKEN_EXCHANGE=True` must be explicitly set - this feature is disabled by default and a default deployment is not affected; (2) `OAUTH_ALLOWED_DOMAINS` must be configured to a specific domain list rather than the default wildcard `*` - deployments without a domain allowlist are unaffected; (3) the attacker must possess a valid, unexpired OAuth access token from the configured provider; and (4) an existing Open WebUI account must already be linked to that provider subject, or `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` must be enabled with a matching email. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects the network-reachable nature of the endpoint but overstates practical exploitability given three non-default prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Open WebUI 0.9.0, which includes commit fb5ef978b adding the domain allowlist check to the token exchange endpoint; no additional configuration changes are required after upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today