CVE-2026-109283

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109283
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109283.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109283
Aliases
  • GHSA-2rr4-q6pg-m5g3
Published
2026-10-12T16:04:46Z
Modified
2026-10-13T02:45:48Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
Details

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109283.json"
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
d3e8bf3405e848cfba377814d0aa7ba7290e414d
Fixed
8bd8b4fac5e059578ac0c74b3c18d11139f88b7d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.11.1"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.11.1
v0.11.2
v0.11.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109283.json"