PYSEC-2026-3652 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

SummaryThe OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of i...

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

GHSA-RQ84-P6RR-VF89 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...