$ the-wire · showcase
OAuth role policy bypass lets denied users sign in via token exchange
By RepoJournal · Filed · About Open WebUI · Composed from the cited sources · methodology
Open WebUI's OAuth role policy can be bypassed: users it denies can still sign in through a token exchange path that skips the check.
A breaking report against open-webui/open-webui says users denied by the OAuth role policy can still sign in via token exchange [1]. The role policy is meant to be the gate on who gets in; the token exchange path reaches authentication without that gate applying, so a denial issued by the policy does not end the session.
No version number, CVE id, fix, or commit is given in the input, so there is nothing yet to pin the affected range or the remediated build to. Treat this as an open bypass, not a patched one [1].
Because the flaw is in how a denied role is enforced against the token exchange flow, the check has to run on that path too. Until the project ships a fix, the exposure is anyone the policy turned away who can still complete the exchange.
Action items
References
- [1] Users denied by the OAuth role policy can still sign in via token exchange open-webui/open-webui ↗
