CVE-2026-109283: Open WebUI: OAuth token exchange retains stale role

MEDIUMPoC AVAILABLECISA: TRACK*

Published October 12, 2026

CISO Take

Open WebUI 0.11.1 through 0.11.3 has an authorization bypass in its OAuth token exchange endpoint. It reads role claims only from the provider's userinfo response, so roles carried only in the ID token are ignored. When no roles claim is found, the user keeps their existing role. A user whose identity provider role has been downgraded or revoked can therefore present a valid provider access token and get a session with their old, possibly admin, privileges. Severity is medium (CVSS 5.4). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so mass exploitation is unlikely now. The exposure is mainly an insider or offboarding problem: stale privileges survive IdP role changes. The package has 3 tracked downstream dependents but 186 other CVEs, which points to a large attack surface and a heavy patching burden. Upgrade to 0.11.4 or later. Until then, audit users whose role in Open WebUI is higher than their IdP role, and consider disabling OAuth token exchange.

Sources:NVDGitHub AdvisoryVulnCheckATLASgithub.com/open-webui

What is the risk?

Medium overall. The attack is network-reachable, low complexity, needs only low privileges (an existing linked account) and no user interaction. Confidentiality and integrity impact are rated low in the CVSS vector, but the real impact depends on the role being retained. If an admin role is kept, the user can reach model configs, API keys, connected backends and other users' chats. Likelihood is limited to users who previously held a higher role. There is no known exploitation, no EPSS signal and no public PoC. Risk is higher for organizations that use OAuth role mapping as the main access control and rely on IdP deprovisioning to remove privileges.

How does the attack unfold?

Initial Access

A user with a linked account whose IdP role was downgraded obtains a valid provider access token.

AML.T0012

Exploitation

The user calls the OAuth token exchange endpoint, and the server finds no roles claim in userinfo and keeps the old role.

AML.T0091.000

Privilege Retention

The server issues a session carrying the previously held elevated role despite the failed role policy.

AML.T0049

Impact

The user accesses chats, knowledge bases, backend credentials and admin functions beyond their current entitlement.

AML.T0085

Initial Access

A user with a linked account whose IdP role was downgraded obtains a valid provider access token.

AML.T0012

Exploitation

The user calls the OAuth token exchange endpoint, and the server finds no roles claim in userinfo and keeps the old role.

AML.T0091.000

Privilege Retention

The server issues a session carrying the previously held elevated role despite the failed role policy.

AML.T0049

Impact

The user accesses chats, knowledge bases, backend credentials and admin functions beyond their current entitlement.

AML.T0085

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

6 steps

Upgrade open-webui to 0.11.4 or later (GHSA-2rr4-q6pg-m5g3).
Until patched, disable or restrict the POST /api/v1/auths/oauth/{provider}/token/exchange endpoint at the reverse proxy if it is not needed.
Reconcile roles: compare each user's Open WebUI role against their current IdP role and manually demote mismatches.
Configure the IdP to emit role claims in the userinfo response, not only in the ID token.
Revoke active sessions and tokens for downgraded or offboarded users.
Detection: review logs for token exchange calls from users whose IdP role no longer meets the OAuth role policy, and for admin actions by those accounts.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

GOVERN 1.4-Risk management process and outcomes are established through transparent policies, procedures, and controls

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109283?

Is CVE-2026-109283 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109283, increasing the risk of exploitation.

How to fix CVE-2026-109283?

1. Upgrade open-webui to 0.11.4 or later (GHSA-2rr4-q6pg-m5g3). 2. Until patched, disable or restrict the POST /api/v1/auths/oauth/{provider}/token/exchange endpoint at the reverse proxy if it is not needed. 3. Reconcile roles: compare each user's Open WebUI role against their current IdP role and manually demote mismatches. 4. Configure the IdP to emit role claims in the userinfo response, not only in the ID token. 5. Revoke active sessions and tokens for downgraded or offboarded users. 6. Detection: review logs for token exchange calls from users whose IdP role no longer meets the OAuth role policy, and for admin actions by those accounts.

What systems are affected by CVE-2026-109283?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted LLM gateways, RAG pipelines, SSO/OAuth-integrated AI platforms.

What is the CVSS score for CVE-2026-109283?

CVE-2026-109283 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted LLM gatewaysRAG pipelinesSSO/OAuth-integrated AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.2

NIST AI RMF: GOVERN 1.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.

Exploitation Scenario

An employee who was an Open WebUI admin through an IdP group is moved out of that group after a team change. The IdP now fails the OAuth role policy for them, but their local account is still linked and still holds the admin role. The employee obtains a valid provider access token and calls POST /api/v1/auths/oauth/{provider}/token/exchange. Open WebUI finds no roles claim in the userinfo response, ignores the ID token and keeps the old role. It issues a session with admin privileges. The employee then reads other users' conversations and knowledge bases, and extracts connected LLM backend credentials.

Weaknesses (CWE)

CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.