$ the-wire · showcase
Open WebUI OAuth token exchange bypasses role policy
By RepoJournal · Filed · About Open WebUI · Composed from the cited sources · methodology
Users denied by the OAuth role policy can still sign in via token exchange.
A breaking change in open-webui/open-webui [1] leaves an authentication bypass open. Users denied by the OAuth role policy can still gain access by exchanging a token, circumventing the intended role-based restrictions.
The affected flow is the token exchange endpoint, which does not re-apply the role policy check after the token is validated. As a result, an account that should be blocked by policy can obtain a session through this alternate path.
Action: Review your OAuth role policy configuration and test the token exchange path if you rely on role-based denial to gate access.
Action items
- → Patch or mitigate the token exchange bypass before exposing OAuth-protected routes open-webui/open-webui [immediate]
References
- [1] Users denied by the OAuth role policy can still sign in via token exchange open-webui/open-webui ↗
