EUVD-2026-103205

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider...

CVE-2026-111823

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider...

CVE-2026-111823: Detection of Error Condition Without Action

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider...

CVE-2026-111823

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider...

CVE-2026-111823

Mage OSS versions through 0.9.80 (before commit 76c4f46 ) are vulnerable to an issue where the system can proceed with session creation when it encounters an unknown OAuth provider . This behavior is categorized under CWE-390 (Detection of Error Condition Without Action). The vulnerability is ass...

CVE-2026-111823

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider...

PT-2026-116178

Name of the Vulnerable Software and Affected Versions Mage OSS versions prior to 0.9.80 commit 76c4f46 Description The software allows session creation to proceed even when an unknown OAuth provider is encountered. OAuth Open Authorization is a standard that allows a website or application to...

EUVD-2026-97585

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109283 Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109283

Open WebUI versions 0.11.1 before 0.11.4 are vulnerable to an authorization bypass in the OAuth token exchange endpoint. The flaw occurs because the system only reads role claims from the provider's userinfo response and retains the user's existing role if no new claim is found, failing to accoun...

CVE-2026-109283 Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109283 Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

PT-2026-110700

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.1 through 0.11.3 Description An authorization bypass exists in the OAuth token exchange process. The system reads role claims exclusively from the provider's userinfo response and retains the user's current role if no...

CVE-2026-109283: Incorrect Authorization

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-102877

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

EUVD-2026-89412

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877

The Fider application (versions prior to 0.38.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a time-of-check time-of-use (TOCTOU) gap during URL validation for webhooks and custom OAuth provider endpoints. An attacker who controls DNS can utilize a DNS rebinding attac...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...