EUVD-2026-75540

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

CVE-2026-88005

Open WebUI versions 0.8.0 through 0.9.0 are affected by a bypass in the OAuth token exchange endpoint . The endpoint issues a valid session for a provider access token without enforcing the email domain allowlist that the standard OAuth login callback applies. As a result, an account whose email ...

CVE-2026-88005 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

CVE-2026-88005 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

PYSEC-2026-3879 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

SummaryChat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages li...

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

SummaryChat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

SummaryOpen WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

PYSEC-2026-3878 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

PYSEC-2026-3877 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

CVE-2026-88002

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:06+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6 2026-09-10 02:31:55+00:00| seen| https://gist.github.com/alon710/401536538bb41a7576b21df62b940fb2...

CVE-2026-88001

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:04+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w 2026-09-10 01:32:33+00:00| seen| https://gist.github.com/alon710/855b51c2ea136c7c49beab7d27d1ef40...

CVE-2026-88000

creationtimestamp| type| source ---|---|--- 2026-09-10 00:32:33+00:00| seen| https://gist.github.com/alon710/48cdccd93c734ae28b1351fbe3368bd9 2026-09-10 00:35:02+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2...

CVE-2026-88006: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-88005: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

The vulnerability of the /oauth/backchannel-logout web interface based on artificial intelligence in Open WebUI allows a perpetrator to trigger a service failure.

The vulnerability of the /oauth/backchannel-logout web interface component in the Open WebUI system is related to asymmetric resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

PT-2026-89453

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.8.9 Description The OAuth token exchange endpoint in backend/open webui/routers/auths.py fails to apply the email domain allowlist that is normally enforced during the OAuth login callback. This occurs becau...

PT-2026-89454

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.11.0 Description The OAuth token exchange endpoint in backend/open webui/routers/auths.py issues a session for a provider access token without executing the OAuth role management checks performed by the...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...