Open WebUI OAuth Token Exchange Vulnerability (CVE-2026-70482) Account Takeover PoC

Vulnerability Overview Vulnerability Name: Account takeover via OAuth token exchange accepting tokens issued to any client Description: The OAuth token exchange endpoint accepts and validates a provider access token by calling the provider's userinfo endpoint. This endpoint only reports whether the token is valid, without checking if the token was issued by the current OAuth client. Attackers can use a victim’s provider access token to create a session in Open WebUI, even if that token was issued by a different OAuth client. Impact Scope Affected Versions: >= 0.8.0, < 0.11.0 Fixed Version: 0.11.0 Severity: High (8.1/10) CVSS v3 Base Metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Remediation Fixed Version: 0.11.0 Remediation Measures: - Added the configuration option to specify trusted OAuth client IDs. - The fixed endpoint verifies whether the token was issued by a trusted OAuth client. - For providers that do not support RFC 7662 token introspection (such as Google, Microsoft Entra ID, GitHub, and Feishu), the token exchange lacks secure configuration and should be disabled. Proof of Concept (POC) Additional Information Reporter: @Classic298 Publication Date: 2 days ago CVE ID: CVE-2026-70482 CWE ID: CWE-287 The above summarizes the key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI OAuth Token Exchange Vulnerability (CVE-2026-70482) Account Takeover PoC

More from this source