CVE-2026-88006

    Dashboard / Vulnerabilities / CVE-2026-88006

    CVE-2026-88006

    Published: 10 Sept 2026Last Modified: 11 Sept 2026

    Summary: Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

    Details: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88006.json, https://github.com/open-webui/open-webui/commit/d799e81edbdc971c6deb096b6474cd95b93504bf, https://github.com/open-webui/open-webui/releases/tag/v0.11.1, https://github.com/open-webui/open-webui/security/advisories/GHSA-wvm9-9g5j-623f, https://nvd.nist.gov/vuln/detail/CVE-2026-88006

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7a7a25766c3dc13fa85544a93d011e00b7c0b2b4
    Fixed -d3e8bf3405e848cfba377814d0aa7ba7290e414d

    Affected versions

    v0.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-88006 | CVE-DB