GHSA-wvm9-9g5j-623f: Medium severity pip/open-webui vulnerability
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint.
Preconditions - ENABLEOAUTHTOKENEXCHANGE=True. It is disabled by default, so a default deployment is not affected. - ENABLEOAUTHROLEMANAGEMENT=True together with OAUTHALLOWEDROLES or OAUTHADMINROLES. Role management is off by default, and deployments not using it are not affected. - A valid, unexpired access token on the configured provider. - An Open WebUI account already linked to that provider subject, or an account with a matching email when OAUTHMERGEACCOUNTSBYEMAIL is enabled. This endpoint never creates accounts, so a token for a subject with no existing account is rejected.
Impact An admin who relies on OAuth role management expects a user to lose access, or lose admin, as soon as the identity provider stops reporting the required role. The login callback does enforce this on the next sign-in. Token exchange kept issuing sessions and never re-evaluated the role, so the user retained working access as their existing account at its existing role, including an admin role the provider had already revoked. The endpoint cannot create an account and cannot raise anyone's role, so this grants continued access rather than new or elevated access.
Fix d799e81ed, released in 0.11.1, runs the same role evaluation on the provider's response that the login callback runs. The exchange is denied with 403 when the reported roles match no allowed or admin role, and the account's role is updated to match the provider otherwise. Upgrading restores the check with no further action.
Root cause The affected component is the OAuth token exchange endpoint in backend/openwebui/routers/auths.py, present in builds from 0.8.0 onward.
The endpoint was added as a second entry point into the same session-issuing path the OAuth login callback uses, but it re-implemented only the identity lookup and not the policy checks surrounding it. Role evaluation lived inside the callback's own body rather than in shared code, so the second caller inherited none of it.
Credits @Classic298
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/open-webuito a version that resolves this vulnerability.Fixed in 0.11.1 - Upgrade
Upgrade
Open WebUI (OAuth token exchange endpoint)to a version that resolves this vulnerability.Fixed in 0.11.1Patch d799e81ed - Compensating control
If you use OAuth role management, ensure `ENABLE_OAUTH_ROLE_MANAGEMENT=True` and the allowed/admin role settings `OAUTH_ALLOWED_ROLES` / `OAUTH_ADMIN_ROLES` are configured, since the OAuth token exchange endpoint can otherwise keep existing sessions without re-evaluating roles until the fix is applied.
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments with ENABLE_OAUTH_TOKEN_EXCHANGE=True and OAuth role management enabled using OAUTH_ALLOWED_ROLES or OAUTH_ADMIN_ROLES are affected. Both token exchange and role management are disabled by default, so default deployments are not affected.
What must an attacker have to obtain a session through the affected endpoint?
They need a valid, unexpired access token from the configured OAuth provider. The token's provider subject must already be linked to an Open WebUI account, or match an existing account email when OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled; the endpoint does not create accounts.
What access can be retained through this issue?
A user whose provider roles would cause the normal OAuth login callback to deny access or demote the user can obtain a working session at their existing Open WebUI role. This can allow a user to retain access or administrative privileges after the identity provider no longer reports the required role.
What can be done if patching is not immediately possible?
Disable the OAuth token exchange feature by setting ENABLE_OAUTH_TOKEN_EXCHANGE=False. This removes a required condition for exploitation.