CVE-2026-70482

CVE-2026-70482 is an OAuth audience confusion vulnerability in Open WebUI versions before 0.11.0, specifically affecting deployments using ENABLE_OAUTH_TOKEN_EXCHANGE=True. The bug isn't a missing parameter — it's a category error: the implementation used the userinfo endpoint to authorize sessions when that endpoint is designed only to identify who a token belongs to, not whether that token grants access to YOUR application. When a user authenticates via an external OAuth provider, the provider issues a token with an audience (aud) claim bound to a specific client ID. The critical security check — validating that the token was issued TO YOUR SERVICE — was never performed. Instead, Open WebUI called the provider's userinfo endpoint, which confirms the token is genuine and returns who the user is, but cannot and does not verify the audience binding. An attacker who registers their own OAuth client with the same provider could craft a token for their own application and use it to authenticate as any user against a vulnerable Open WebUI instance. This is a known class of vulnerability with CVEs dating back to 2019, yet it keeps appearing because the correct validation — checking that the aud claim matches your own client ID — isn't automatically enforced by any major OAuth library. The fix in 0.11.0 required adding provider-specific audience claim handling, confirming what this bug reveals: the multi-provider design that made Open WebUI flexible also made the convenient universal validator (userinfo) inadequate. The libraries abstract identity, not authorization. That's a semantic distinction every OAuth implementation must handle at the application layer because the ecosystem has collectively decided audience validation is the consuming app's responsibility, not the SDK's. If you're running Open WebUI, upgrade to 0.11.0 or later immediately. Check your logs for anomalous OAuth token exchanges — particularly successful authentications from providers where the user has no prior account. This vulnerability is trivially exploitable in any threat model where the attacker can register an OAuth client with the same provider. The CVSS of 8.1 reflects the instance; the pattern is present in every self-hosted platform that optimized for provider breadth without audience-specific token validation.

Reviewed through automated stages and approved by a human before publication.