EUVD-2026-75541
GHSA-wvm9-9g5j-623f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
PR:L because exploitation requires a valid OAuth provider access token, meaning the attacker must be authenticated with the IdP; C:L/I:L reflects retained unauthorized role access with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.
AnalysisAI
Open WebUI versions 0.8.0 through 0.11.0 contain an authorization bypass in the OAuth token exchange endpoint that allows users to obtain valid sessions without triggering the role management logic enforced by the normal OAuth login callback. Users whose identity provider roles would cause Open WebUI to deny or demote them on standard login can instead present a provider access token directly to the /token_exchange endpoint and receive a session at their existing (unauthorized) role level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | OAuth authentication must be configured and enabled on the Open WebUI instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 6.5 Medium score carries AV:N/AC:L/PR:N/UI:N, but the PR:N designation is questionable - exploitation requires a valid access token from the configured OAuth provider, meaning the attacker must remain an active, authenticated user in that identity provider. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Open WebUI v0.11.1, which resolves the issue by adding the missing role management calls to the token exchange endpoint; the release is available at https://github.com/open-webui/open-webui/releases/tag/v0.11.1 and the security advisory is at https://github.com/open-webui/open-webui/security/advisories/GHSA-wvm9-9g5j-623f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today