CVE-2026-70482

Executive Summary

CVE-2026-70482 is a critical authentication bypass vulnerability in Open WebUI versions 0.8.0 through 0.11.0, affecting deployments where the ENABLE_OAUTH_TOKEN_EXCHANGE configuration option is set to True. The flaw permits attackers with access to a valid OAuth access token minted for any client registered with the same OAuth provider to exchange that token for a full Open WebUI session, impersonating the original token owner without proper authorization. This improper authentication issue (CWE-287) carries a CVSS score of 8.1 (High) and can lead to complete compromise of the self-hosted AI platform's data and functionality, including unauthorized access to AI conversations, prompts, and administrative capabilities.

Technical Analysis

The vulnerability resides in the OAuth token exchange endpoint implemented in Open WebUI's authentication module, specifically within the route /oauth/{provider}/token/exchange. The core flaw is a missing validation step: when a request is made to this endpoint with a raw provider access token, the application validates the token by calling the provider's userinfo endpoint but fails to verify which OAuth client application the token was originally issued to.

In a correct OAuth 2.0 implementation, access tokens are scoped to a specific client application (identified by a client_id). The token exchange flow must confirm that the presented token belongs to the same OAuth client (that is, the Open WebUI registered client) before accepting it. Open WebUI 0.8.0 through 0.11.0 fails this verification — the application only checks that the token is valid and maps it to the associated user account, without confirming the token's client_id matches the OAuth client configured for Open WebUI.

The attack surface is significant for organizations that use a shared OAuth provider (such as a corporate SSO infrastructure, Okta, Azure AD, GitHub, or Google) where multiple applications have registered OAuth clients against the same provider. Any third-party application holding a valid access token for a user — even an application the organization never authorized for Open WebUI access — can submit that token to the vulnerable token exchange endpoint and receive a session cookie valid for Open WebUI.

The vulnerable code path is triggered when ENABLE_OAUTH_TOKEN_EXCHANGE=True, which is an explicit configuration enabling this feature. The exchange endpoint accepts POST requests with a JSON payload containing the raw access token. The server then makes a server-side request to the OAuth provider's userinfo endpoint, extracts the user's email or other identifier, and creates a local session. The missing step is comparing the token's aud (audience) or client_id claim against the registered Open WebUI OAuth client identifier.

Exploitation requires only network access to the Open WebUI instance and possession of any valid access token for the target user from the shared OAuth provider. The token does not need to have been minted for Open WebUI specifically, nor does the attacker need credentials for Open WebUI itself. The impact is asymmetric — a token for an unrelated application becomes a valid access credential for Open WebUI.

Due to the stateful relationship between access tokens and client registrations, the vulnerability does not require the attacker to know any Open WebUI-specific secrets or credentials. The attacker only needs the access token value itself, which could be obtained through separate application compromises, credential theft, or in scenarios where multiple applications under the same provider are operated by different entities.

Exploitation Scenarios

Scenario 1: Cross-Application Token Reuse

1. Reconnaissance: The attacker identifies an Open WebUI deployment exposed on the internet (common on ports 8080, 3000, or behind reverse proxies) that appears to have ENABLE_OAUTH_TOKEN_EXCHANGE=True enabled. This is often discoverable via the login page showing OAuth provider buttons or through Shodan searches for "Open WebUI" in server banners.

2. Token Acquisition: The attacker obtains a valid OAuth access token that was issued to a different application — not Open WebUI — for a user who also has an account in the target Open WebUI instance. This could be achieved through:

   • Compromising another application's session storage or its OAuth token cache
   • Exploiting a separate vulnerability in another application that shares the same OAuth provider
   • Intercepting tokens in transit (where tokens are improperly transmitted over unencrypted channels)

3. Exploit Trigger: The attacker crafts an HTTP POST request to:

   POST /oauth/github/token/exchange
   Content-Type: application/json
   
   {
     "access_token": "<stolen-or-reused-access-token>"
   }
   

   The provider name in the URL path corresponds to the OAuth provider slug (e.g., github, google, azure), which must match the provider that minted the token.

4. Session Establishment: The vulnerable server-side code calls the OAuth provider's userinfo endpoint, retrieves the user's profile, creates a valid Open WebUI session token, and returns it in the response (typically in a JSON token field or as a Set-Cookie header).

5. Post-Exploitation: The attacker uses the obtained session token to access the victim's Open WebUI account. This grants access to:

   • All historical AI conversations and queries (potentially containing sensitive corporate data, IP, credentials discussed in prompts)
   • Any RAG (Retrieval-Augmented Generation) document collections uploaded to the platform
   • The ability to issue new prompts in the victim's name, which could be used for phishing or data exfiltration via AI model outputs
   • If the victim has administrative privileges: full platform control, model configuration changes, user management, and access to all other users' conversations

Scenario 2: Privilege Escalation Within a Multi-Tenant Environment

1. In an environment where the organization runs multiple self-hosted applications all registered against the same corporate SSO, an attacker who compromises a low-privilege application (e.g., a legacy internal tool with a known CVE) can harvest access tokens from that application's session store.

2. The attacker uses those tokens against Open WebUI's vulnerable token exchange endpoint to gain access to the AI platform, potentially escalating from a low-impact application compromise to accessing sensitive AI conversations and administrative functions — a substantial privilege escalation in terms of data exposure.

Impact Assessment

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates an attacker can exploit this remotely without authentication privileges, requiring only user interaction in some scenario variants and no special conditions. The confidentiality impact is HIGH — an attacker gains full read access to all conversations, prompts, documents, and potentially model configurations within the affected Open WebUI instance. The integrity impact is HIGH — the attacker can manipulate the platform, modify settings, create documents, and perform actions as the impersonated user. Availability is not impacted.

The business impact is substantial for organizations relying on Open WebUI for AI-assisted workflows. Self-hosted AI platforms often process sensitive data, including source code, proprietary business documents, internal policies, and potentially personal data. Exposure of these conversations to unauthorized parties constitutes a significant data breach with potential regulatory (GDPR, HIPAA, CCPA) and reputational consequences. Additionally, if the AI platform is connected to downstream systems (via plugins or API integrations for search, databases, or other tools), the attacker may be able to leverage the platform to further penetrate the network.

The blast radius is amplified by the fact that the vulnerability does not require prior access to Open WebUI — it only requires an OAuth token from the same provider. Given that modern enterprises typically consolidate on one or two SSO providers, this effectively means any application compromise within the organization can be pivoted into an Open WebUI session takeover.

Detection Guidance

Sigma Rule

title: Open WebUI OAuth Token Exchange Endpoint Access
id: 8f3a2c7e-1b4d-4f6a-9c2e-5a8b3d1f7e2a
status: experimental
description: Detects requests to the Open WebUI OAuth token exchange endpoint, which may indicate exploitation of CVE-2026-70482
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70482
author: ValtersIT SOC
date: 2025/06/15
logsource:
    category: webserver
    product: nginx
    definition: 'Access logs for the Open WebUI server'
detection:
    selection_tok_exchange:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/oauth/'
        cs-uri-stem|endswith: '/token/exchange'
    selection_response_success:
        sc-status: 200
    condition: selection_tok_exchange and selection_response_success
    timeframe: 5m
falsepositives:
    - Legitimate token exchange initiated by the Open WebUI frontend during normal OAuth login flow
level: medium
tags:
    - attack.t1190
    - cve.2026.70482

YARA Rule

rule OpenWebUI_OAuth_Token_Exchange_Exploit {
    meta:
        author = "ValtersIT"
        description = "Detects HTTP POST requests to Open WebUI OAuth token exchange endpoints"
        cve = "CVE-2026-70482"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70482"
        date = "2025-06-15"
    strings:
        $exchange_path = "/token/exchange" ascii nocase
        $oauth_prefix = "/oauth/" ascii nocase
        $access_token_key = "access_token" ascii nocase
        $content_type_json = "application/json" ascii nocase
    condition:
        uint16(0) == 0x0a0d and
        any of ($exchange_path*) and
        any of ($oauth_prefix*) and
        any of ($access_token_key*) and
        any of ($content_type_json*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-70482 - Open WebUI OAuth Token Exchange Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/oauth/"; http_uri; content:"/token/exchange"; http_uri; content:"access_token"; http_client_body; reference:cve,2026-70482; classtype:attempted-user; sid:2026070482; rev:1; priority:2;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where event.type == "connection" and destination.port in (80, 443, 8080, 3000) ]
  [ http where
      http.request.method == "POST" and
      wildcard(http.request.uri, "/oauth/*/token/exchange") ]
  [ http where
      http.response.status_code == 200 and
      http.request.body.content contains "access_token" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "/oauth/%/token/exchange"
| eval suspicious = if(match(uri_path, "/oauth/(github|google|azure|gitlab|okta|auth0|keycloak)/token/exchange"), 1, 0)
| where suspicious=1
| stats count by clientip, uri_path, status, _time
| sort - _time
| table _time, clientip, uri_path, status, count

Wazuh OSSEC Rule

<group name="web,openwebui,cve-2026-70482,">
  <rule id="100482" level="10">
    <decoded>json</decoded>
    <field name="http.request.method">POST</field>
    <field name="http.request.uri" type="pcre2">/oauth/.+</field>
    <field name="http.request.uri" type="pcre2">token\.exchange</field>
    <description>Possible CVE-2026-70482 exploitation attempt: Open WebUI OAuth token exchange endpoint accessed</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed)

The patch is claimed to be included in Open WebUI version 0.11.0, per the NVD description. However, this is a single-source confirmation and has not been independently verified.

Immediate Mitigations:

1. Disable the Feature: If OAuth token exchange is not strictly required for your deployment, set ENABLE_OAUTH_TOKEN_EXCHANGE=False in the Open WebUI configuration. This is the fastest mitigation and should be applied immediately while the patch is validated.

2. Restrict Network Access: If the token exchange endpoint must remain available, restrict access to the Open WebUI instance to trusted internal networks only, using network-level ACLs or firewall rules. Apply IP allowlisting to prevent external attackers from reaching the vulnerable endpoint.

3. Review OAuth Provider Logs: Check OAuth provider audit logs for unusual token exchange activity, particularly token exchanges that do not correspond to known login flows from your organization's IP ranges.

Patch/Upgrade Steps:

1. Upgrade Open WebUI to version 0.11.0 or later. For containerized deployments:

   docker pull ghcr.io/open-webui/open-webui:main
   docker-compose up -d
   

   For source installations, pull the latest release from the official repository and rebuild.

2. After upgrading, verify the version number via the Open WebUI admin interface or API to confirm the patch has been applied.

3. Re-enable ENABLE_OAUTH_TOKEN_EXCHANGE=True only after confirming the patched version functions correctly with your OAuth provider setup.

Long-Term Hardening:

1. Review OAuth Client Registrations: Audit all OAuth client registrations against your OAuth provider. Remove or deactivate any unused or unauthorized client applications.

2. Implement Token Audience Validation: If your OAuth provider supports custom claims or requires audience restrictions, configure the provider to restrict access tokens to the intended audience and verify Open WebUI validates token claims (check aud claim in the JWT).

3. Enable Session Tightening: After patching, review Open WebUI session management settings — enforce short session timeouts and ensure no orphaned sessions remain from previous exploits.

4. Monitor for Known Indicators: Continuously watch for POST requests to /oauth/*/token/exchange endpoints, especially if those requests come from IPs not recognized as legitimate users.

5. Stay Informed: Given the patch confirmation is only 2/4 confidence, monitor Open WebUI release notes, NVD updates, and security advisories for confirmation and any additional patches or improvements.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70482
2. Open WebUI Official Repository: https://github.com/open-webui/open-webui
3. Open WebUI Release Notes: https://github.com/open-webui/open-webui/releases
4. CWE-287 Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Known Exploitation Campaigns: As of this writing, no in-the-wild exploitation campaigns have been publicly confirmed. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the High severity CVSS score and the relative simplicity of exploitation (requiring only a valid OAuth token from a shared provider), organizations should treat this as a likely target for opportunistic attackers.