CVE-2026-88005

Executive Summary

CVE-2026-88005 is an authorization bypass (CWE-863, incorrect authorization) in Open WebUI, a self-hosted AI platform. From version 0.8.0 until 0.9.0, the OAuth token exchange endpoint issues an authenticated session for a provider access token without applying the email domain allowlist that the standard OAuth login callback enforces. An attacker who can complete an OAuth flow with a disallowed email domain — for example, a valid account on the upstream identity provider outside the permitted domain — can obtain a fully working session, bypassing the domain restriction that administrators rely on to gate access to the platform.

Technical Analysis

Open WebUI supports OAuth/OIDC-based login through external identity providers. Two distinct code paths exist for converting an external OAuth token into a local Open WebUI session:

1. The normal OAuth login callback — the browser-redirect flow. This path validates the identity of the incoming user and, critically, enforces an email domain allowlist: if the authenticated user's email domain is not on the administrator-configured allowlist, the callback refuses to create a session.

2. The OAuth token exchange endpoint — an endpoint intended to exchange a provider access token for an Open WebUI session. Per the NVD description, this path issues a session without applying the email domain allowlist that the callback enforces.

The defect is a classic inconsistent-enforcement / missing-authorization-check vulnerability (CWE-863). The two entry points into the session-issuance logic do not share the same authorization gate. Because the token exchange path skips the allowlist check, the email-domain restriction is only a partial control: it can be bypassed entirely by using the token exchange endpoint rather than the browser callback.

The root cause is a failure to centralize authorization policy. The allowlist check is applied at one call site (the callback) but not at the other (the token exchange endpoint). Any input reaching the token exchange endpoint that would have been rejected by the callback is instead trusted and converted into a session.

Scope and preconditions: The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity attack requiring no prior privileges and no user interaction. This is consistent with an attacker who possesses — or can obtain — a provider access token for an account whose email domain the callback would reject. Notably, the attacker still needs a valid upstream provider token; the vulnerability removes the domain authorization check, not authentication to the provider. The impact metrics (C:L/I:L/A:N) reflect limited confidentiality and integrity impact — the attacker gains access to the platform (and the data/models accessible to the resulting account) but there is no direct availability impact.

Because the token exchange path issues a session for the provider access token, the resulting session's privileges depend on how Open WebUI maps the external identity to a local account (including default role assignment for first-time OAuth users). The NVD description does not specify role-mapping behavior, so the exact privilege level of the obtained session cannot be determined from the available data.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-88005. The attack chain below is inferred from the vulnerability class (authorization bypass via inconsistent enforcement at an OAuth token exchange endpoint) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a publicly reachable Open WebUI instance (versions 0.8.0 through 0.9.0) that is configured with OAuth/OIDC login and an email domain allowlist. This can be performed via Shodan/Censys queries or direct browsing of exposed instances. The attacker must also determine the configured OAuth provider and the token exchange endpoint exposed by the instance.

2. Triggering the flaw class. The attacker obtains a valid OAuth provider access token for an identity whose email domain would be rejected by the normal login callback (for example, a legitimate account on the upstream identity provider that is outside the permitted domain). Because the attack requires no prior privileges and no user interaction on the target, the attacker can proceed directly. The attacker then submits that provider access token to the OAuth token exchange endpoint. The endpoint, per the NVD description, performs the exchange and issues an Open WebUI session without applying the email domain allowlist.

3. Execution (vulnerability-class level). The distinguishing step is choosing the token exchange endpoint instead of the browser login callback. The same token that the callback would refuse (on domain grounds) is accepted here. The response is a working Open WebUI session. No payload injection or memory corruption is involved — the "payload" is simply a request to the mis-authorized endpoint carrying a token for a disallowed-domain identity.

4. Post-exploitation impact. With a valid session, the attacker can access Open WebUI as an authenticated user. What that user can see or do depends on how Open WebUI provisions the account from the external identity (role assignment is not specified in the description). Potential consequences include unauthorized access to the AI platform, its models, configuration, and any chats, documents, or knowledge bases associated with the provisioned account. Given CVSS integrity impact of Low (I:L), the attacker may also be able to make limited changes within the platform as that user. There is no availability impact (A:N). Because the session is legitimate from the platform's perspective, the activity blends into normal user traffic and may not trigger authentication-failure alarms.

Impact Assessment

• Confidentiality (C:L): The attacker gains access to data reachable by the provisioned session. Limited impact reflects that the account is likely a standard user account rather than an administrative one; the exact scope is not specified.
• Integrity (I:L): The attacker can perform actions permitted to the obtained session (e.g., submitting prompts, creating/altering owned content). Limited impact.
• Availability (A:N): No direct availability impact.
• Attack Vector (AV:N) / Complexity (AC:L) / Privileges (PR:N) / User Interaction (UI:N): Remotely exploitable, low complexity, no prior privileges, no user interaction, per the CVSS vector.
• Scope (S:U): Impact is confined to the Open WebUI authorization scope.

Business impact. The core control that administrators use to restrict platform access — the email domain allowlist — is enforceable only on one of two session-issuance paths. Any organization relying on domain allowlisting to keep the platform limited to corporate identities cannot rely on that control for Open WebUI 0.8.0 through 0.9.0. For deployments where the platform aggregates sensitive internal data (documents, RAG knowledge bases, model access), unauthorized sessions represent a data-exposure and accountability risk. Blast radius is limited to instances running affected versions with OAuth enabled and a domain allowlist configured; instances using local authentication only, or without an allowlist, are not affected by this specific bypass.

Detection Guidance

Sigma Rule

title: Open WebUI OAuth Token Exchange Bypass - Session Issuance Without Domain Allowlist
id: 8f3a1c2e-9b47-4d6a-b1e2-0c7d5a9f4e21
status: experimental
description: Detects access to the Open WebUI OAuth token exchange endpoint that may indicate
  exploitation of CVE-2026-88005, where a session is issued for an OAuth provider token
  without applying the email domain allowlist enforced by the login callback.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88005
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: open_webui
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/oauth'
      - '/token'
  selection_exchange:
    cs-uri-stem|endswith:
      - '/oauth/token'
      - '/token/exchange'
  selection_verb:
    cs-method: 'POST'
  condition: selection_verb and (selection_endpoint or selection_exchange)
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - cs-User-Agent
falsepositives:
  - Legitimate OAuth login flows that use the token exchange endpoint
  - Automated provisioning or SSO integrations
level: medium

YARA Rule

rule CVE_2026_88005_OpenWebUI_OAuth_Exchange_Bypass
{
    meta:
        description = "Detects Open WebUI source/artifacts referencing the OAuth token exchange endpoint that omits the email domain allowlist check (CVE-2026-88005)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88005"
        cve = "CVE-2026-88005"
        date = "2026-01-01"

    strings:
        $a1 = "oauth/token" ascii nocase
        $a2 = "token/exchange" ascii nocase
        $b1 = "allowed_email_domains" ascii nocase
        $b2 = "email_domain" ascii nocase
        $c1 = "sign_in_with_oauth" ascii nocase
        $c2 = "create_session" ascii nocase

    condition:
        (any of ($a*)) and (any of ($b*)) and (any of ($c*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88005 Open WebUI OAuth Token Exchange Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"oauth"; nocase; http.uri; content:"token"; nocase; http.header; content:"Authorization"; nocase; reference:cve,CVE-2026-88005; classtype:attempted-user; sid:202688005; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and
    http.request.body.bytes > 0 and
    wildcard(http.request.headers: "*Authorization*") and
    (wildcard(url.path: "*oauth*" or wildcard(url.path: "*token*")) or
     wildcard(url.path: "*exchange*")) ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem)
| eval method=upper(coalesce(method, cs_method, http_method))
| where method="POST"
| where match(uri, "(?i)(oauth|token)")
| where (match(uri, "(?i)token") AND match(uri, "(?i)exchange")) OR match(uri, "(?i)oauth/token")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest_host
| where count > 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count
| table src_ip dest_host uris count first_seen last_seen

Wazuh OSSEC Rule

<group name="open_webui,oauth,web,">
  <rule id="202688" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <description>Possible CVE-2026-88005 exploitation: Open WebUI OAuth token exchange endpoint accessed (authorization bypass).</description>
    <match>CVE-2026-88005</match>
    <regex type="pcre2">(?i)POST\s+\S*(oauth|token)\S*\s+HTTP/\d\.\d</regex>
    <options>no_full_log</options>
    <mitre>
      <id>T1078.004</id>
    </mitre>
    <group>access_control_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• If OAuth/OIDC with an email domain allowlist is not operationally required, disable OAuth login or remove the reliance on the allowlist as a security boundary on affected instances.
• Restrict network access to the Open WebUI OAuth token exchange endpoint so it is not reachable by untrusted clients (e.g., place it behind an authenticating reverse proxy, VPN, or IP allowlist).
• Where feasible, disable the token exchange endpoint if it is not needed for the deployment's login flow.
• Enable verbose logging and alerting on all session-issuance events, particularly the token exchange path, and monitor for sessions created for identities outside the configured domain allowlist.
• Because the flaw issues a valid session, monitor Open WebUI access logs for sessions originating from unexpected identities rather than relying on authentication-failure detection.

2) Patch / upgrade steps.

• Per the NVD description, this issue is fixed in Open WebUI 0.9.0. Upgrade affected instances (0.8.0 through 0.9.0) to 0.9.0 or later. Validate after upgrade that the email domain allowlist is enforced on both the login callback and the token exchange path.
• Re-verify configuration (allowed email domains, OAuth client settings) post-upgrade and confirm no bypass remains on the token exchange endpoint.
• No vendor advisory URL or commit hash was provided in the available intelligence; consult the Open WebUI project's official release notes for version 0.9.0 for patch details.

3) Long-term hardening.

• Centralize authorization policy: enforce the email domain allowlist (and all session-issuance authorization checks) in shared session-creation logic so every entry point applies it identically.
• Adopt a security test that exercises all session-issuance paths against the allowlist policy, preventing future inconsistent-enforcement regressions.
• Apply least privilege to OAuth-provisioned accounts by default; require explicit role assignment for elevated access.
• Maintain an inventory of self-hosted AI platform instances, keep them on supported versions, and subscribe to the vendor/project's security advisories.

References

• NVD — CVE-2026-88005: https://nvd.nist.gov/vuln/detail/CVE-2026-88005
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078.004 — Valid Accounts: Cloud Accounts: https://attack.mitre.org/techniques/T1078/004/
• Open WebUI official project/release notes (version 0.9.0 fix reference) — consult the project's official repository and release page.
• FIRST EPSS: Not yet scored for this CVE (no EPSS value fabricated).

Threat actor / exploit-in-the-wild evidence: None available. No CISA KEV listing, no public PoC, no Nuclei template, and no exploit code were identified in the provided intelligence. The attack chain described is inferred from the vulnerability class and the NVD description.