CVE-2026-88006

Executive Summary

CVE-2026-88006 is an improper authorization vulnerability (CWE-863) in Open WebUI, a self-hosted AI platform. From version 0.8.0 until 0.11.1, the OAuth token exchange endpoint issues a valid session for a provider access token without executing the OAuth role management logic that the normal login callback performs. As a result, a user whose provider-assigned roles would otherwise be rejected or demoted by the login callback can still obtain a working session at their existing (elevated) role through the token exchange endpoint. The issue is rated CVSS 6.5 (Medium) and is fixed in version 0.11.1.

Technical Analysis

Open WebUI supports authentication against external OAuth/OIDC identity providers. The platform normally enforces role management during the OAuth login callback: provider-supplied role claims are evaluated, and users whose roles would be refused (e.g., deactivated, unauthorized, or disallowed) or demoted (e.g., from admin to a lower role) are handled accordingly before a session is created.

CVE-2026-88006 breaks this invariant. The OAuth token exchange endpoint accepts a provider access token and issues a session without running the same OAuth role management logic that the callback path applies. This is a classic CWE-863 (Incorrect Authorization) flaw caused by inconsistent enforcement across two code paths that perform analogous authentication operations. Because authorization decisions are made in the callback but omitted in the token exchange endpoint, the token exchange becomes an authorization bypass.

Key exploited property: A user who holds a provider access token — but whose provider roles the login callback would refuse or demote — can still redeem that token at the exchange endpoint and receive a working Open WebUI session at their existing role. This means:

• A user who should have been denied access entirely can still authenticate.
• A user who should have been demoted retains their higher role.

No public proof-of-concept, Nuclei template, or exploit code is available, and no specific function names, URL paths, or parameter names are provided in the NVD description. The technical claims above are limited strictly to the behaviors described. The exact route name, parameter names, and payload structure of the token exchange endpoint are not disclosed in the source data and are therefore not enumerated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper authorization / authorization bypass in an OAuth token exchange flow). All steps are described at the vulnerability-class level because the description does not disclose specific endpoint paths, parameter names, or code identifiers.

1. Reconnaissance / Target Identification: An attacker identifies a reachable Open WebUI instance (versions 0.8.0 through 0.11.0) that is configured with an external OAuth/OIDC identity provider. Because the vulnerable component is the token exchange endpoint, the attacker only needs network reachability to the platform plus a valid access token from the configured identity provider. No authenticated Open WebUI session or special privileges are required (CVSS PR:N).

2. Triggering the Flaw: The attacker obtains a provider access token through the identity provider (for example, a token issued to a low-privilege or restricted account, or an account whose roles the Open WebUI login callback would reject or demote). Instead of going through the normal OAuth login callback — which performs role management — the attacker submits the token directly to the OAuth token exchange endpoint.

3. Execution Method (class level): A network request to the token exchange endpoint with the provider access token. Because that endpoint omits the role management logic, the server returns a valid Open WebUI session rather than denying or demoting the user. This is an authorization bypass achieved by using an alternate, less-guarded code path.

4. Post-Exploitation Impact: The attacker gains a working session at their existing role. Where that role would have been refused, the attacker obtains access they should not have. Where the role would have been demoted, the attacker retains elevated (potentially administrative) privileges. From that session the attacker can interact with the platform with the privileges of the retained role. The CVSS impact subscores (C:L/I:L/A:N) indicate limited confidentiality and integrity impact and no availability impact.

Impact Assessment

CVSS 3.1 base score: 6.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions or race conditions described.
• Privileges Required (PR:N): The attacker needs no prior Open WebUI account/privileges; possession of a provider token suffices.
• User Interaction (UI:N): No victim action required.
• Scope (S:U): Impact confined to Open WebUI's security authority.
• Confidentiality (C:L): Limited — unauthorized access to data visible at the retained role.
• Integrity (I:L): Limited — ability to perform state-changing actions permitted at the retained role.
• Availability (A:N): No availability impact.

Business impact: Open WebUI is a self-hosted AI platform typically deployed internally and integrated with an enterprise identity provider. A broken authorization boundary between two authentication paths undermines the organization's centralized identity governance — accounts that should be denied or demoted by IdP role claims can retain access. This is most relevant to organizations relying on provider role claims for least-privilege enforcement. The blast radius is limited to Open WebUI instances running affected versions (0.8.0 - 0.11.0) with OAuth configured. There is no evidence of active exploitation (CISA KEV: NO; EPSS not yet scored; no public PoC/exploit).

Detection Guidance

Sigma Rule

title: Open WebUI OAuth Token Exchange Authorization Bypass (CVE-2026-88006)
id: 6e2b9f2a-1c44-4d2b-9d11-88a0c1e0b7f1
status: experimental
description: Detects successful OAuth token exchange endpoint access that issues a session without prior OAuth login callback role management, as described in CVE-2026-88006 for Open WebUI 0.8.0 through 0.11.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88006
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1078
  - attack.initial_access
  - cve.2026-88006
logsource:
  product: open_webui
  service: web
detection:
  selection_endpoint:
    url.path|contains:
      - '/oauth'
      - '/token'
      - '/exchange'
  selection_auth:
    http.response.status_code: 200
  condition: selection_endpoint and selection_auth
fields:
  - src_ip
  - url.path
  - http.response.status_code
falsepositives:
  - Legitimate OAuth providers performing token exchange through the normal login flow
level: medium

YARA Rule

rule CVE_2026_88006_OpenWebUI_OAuth_TokenExchange
{
    meta:
        description = "Detects Open WebUI OAuth token exchange authorization bypass (CVE-2026-88006)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88006"
        cve = "CVE-2026-88006"
    strings:
        $s1 = "oauth" nocase
        $s2 = "token" nocase
        $s3 = "exchange" nocase
        $s4 = "role" nocase
    condition:
        any of ($s1*) and any of ($s2*) and any of ($s3*) and $s4
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88006 Open WebUI OAuth Token Exchange Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"token"; nocase; http.uri; content:"oauth"; nocase; http.uri; content:"exchange"; nocase; reference:cve,2026-88006; classtype:attempted-admin; sid:202688006; rev:1;)

Elastic Detection

sequence by source.ip
  [ network where http.request.method == "POST" and
      stringContains(http.request.uri, "token") and
      stringContains(http.request.uri, "oauth") and
      stringContains(http.request.uri, "exchange") ]
  [ network where http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| search (uri_path="*oauth*" AND uri_path="*token*" AND uri_path="*exchange*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, status
| where status=200
| table src_ip, uri_path, status, first_seen, last_seen, count
| sort - count

Wazuh OSSEC Rule

<group name="open_webui,web,cve-2026-88006">
  <rule id="880060" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/oauth</field>
    <field name="url">/token</field>
    <field name="url">/exchange</field>
    <field name="status">200</field>
    <description>CVE-2026-88006: Open WebUI OAuth token exchange authorization bypass attempt (possible session issued without role management).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_88006,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; no vendor fix, workaround, or affected-version package data supplied by tracked sources).

1. Immediate mitigations:

   • Upgrade to Open WebUI 0.11.1, which the NVD description states fixes the issue. This is the primary and authoritative remediation.
   • Until upgrade is possible, restrict network access to the Open WebUI OAuth/token exchange endpoint to trusted networks only (e.g., behind VPN or IP allowlisting), since the flaw is remotely reachable with no privileges (AV:N/PR:N).
   • Review identity-provider role assignments and deactivate provider accounts whose roles the login callback would reject or demote; a token for such an account is the vector described.
   • Monitor for sessions created via the token exchange endpoint rather than the login callback, and audit session-to-role mappings for anomalies.

2. Patch/upgrade steps:

   • Determine the deployed Open WebUI version; if it falls in the range 0.8.0 through 0.11.0, treat it as affected.
   • Upgrade to 0.11.1 or later.
   • Verify that both the OAuth login callback and the token exchange endpoint apply identical OAuth role management after upgrade.
   • Note: no specific commit, patch diff, or advisory URL is available in the provided data, so rely on the version threshold given in the NVD description.

3. Long-term hardening:

   • Centralize authorization logic so all authentication paths (callback and token exchange) share a single, tested role-management routine; avoid divergent code paths for equivalent operations (root cause of CWE-863).
   • Enforce least privilege on identity-provider role claims and periodically reconcile provider roles with platform sessions.
   • Log and alert on all session issuance events, tagging whether they originated from the login callback or token exchange, to detect bypass attempts.
   • Keep Open WebUI current and subscribe to project security advisories.

References

• NVD — CVE-2026-88006: https://nvd.nist.gov/vuln/detail/CVE-2026-88006
• Open WebUI project (vendor): https://github.com/open-webui/open-webui (verify version 0.11.1 release notes for the fix)
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: None. CISA KEV status is NO, no public PoC/exploit code or Nuclei template is available, and EPSS has not yet been scored by FIRST.org. No named threat actor campaigns are associated with this CVE in the provided data.