GHSA-rq84-p6rr-vf89 is a high-severity (CVSS 8.1) Improper Authentication vulnerability in open-webui. A fix is available for open-webui — see the affected versions and patch details below.
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for GHSA-rq84-p6rr-vf89.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-rq84-p6rr-vf89 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 376,715 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
open-webuiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of its own. Anyone holding an access token minted for any client registered with the same provider could exchange it for an Open WebUI session as that token's user, including applications the operator does not control and has never authorised.
Preconditions
ENABLE_OAUTH_TOKEN_EXCHANGE=True. Disabled by default, so a stock deployment is not affected.- The victim already has an Open WebUI account. The endpoint does not create users.
- The attacker can obtain a provider access token for the victim, typically by having them sign in to an unrelated OAuth application on the same provider. On public providers, registering that application is self-service.
- The subject identifier the attacker's client observes matches the one stored on the victim's account. Google, GitHub, Okta and self-hosted OIDC servers in default configuration issue a subject that is stable across all clients and are directly affected. Microsoft Entra ID issues per-application subjects, so the match fails there unless
OAUTH_MERGE_ACCOUNTS_BY_EMAILis enabled orOAUTH_SUB_CLAIMpoints at a globally stable claim such asoid. OAUTH_ALLOWED_DOMAINSis enforced on this endpoint but does not constrain the attack, because the impersonated user is a legitimate member of an allowed domain.
Impact
Full account takeover of any user whose provider access token the attacker can obtain. The endpoint applies no role gating, so the issued session carries the target account's role, and a targeted administrator yields an administrator session. The victim never interacts with Open WebUI and has no opportunity to notice.
The standard OAuth callback is not affected. It obtains its token through an authorization-code exchange authenticated with the client secret, so the token is inherently bound to Open WebUI's own client, and the ID token's audience is validated.
Fix
Fixed in 0.11.0. The endpoint now resolves which OAuth client a presented token was issued to through RFC 7662 token introspection, and rejects tokens minted for any client not named in OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS. Only the introspected client_id is honoured; the aud field is ignored, because it names intended resource servers rather than the issuing client and several providers let any client place another client's identifier there.
Upgrading alone is not sufficient. The check is opt-in: with OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS unset the endpoint behaves as it did before, so any deployment running with ENABLE_OAUTH_TOKEN_EXCHANGE=True must also set that list. It is a deploy-time environment variable and cannot be changed from the admin interface, so a compromised administrator session cannot widen the trust boundary at runtime.
Providers that do not implement RFC 7662 introspection, including Google, Microsoft Entra ID, GitHub and Feishu, cannot be restricted this way at all. On those, token exchange has no safe configuration and should be left disabled.
Root cause
backend/open_webui/routers/auths.py,token_exchange(POST /api/v1/auths/oauth/{provider}/token/exchange)
Token exchange skips the authorization-code step entirely and trusts a token supplied by the caller. The only validation performed was a userinfo lookup, which answers whether a token is valid rather than who issued it, so the endpoint had no way to distinguish a token minted for Open WebUI from one minted for an unrelated application.
Proof of concept
Reproduced against a mock OIDC provider serving two tokens for the same end user, minted for two different clients, with OAUTH_ALLOWED_DOMAINS=corp.example actively enforced.
| Case | Token | Result |
|---|---|---|
| Control | not recognised by the provider | 400 rejected |
| Outsider's own account, non-allowed domain | minted for attacker-evil-app | 403 blocked by domain allowlist |
| Victim's account, foreign client | minted for attacker-evil-app | 200, session issued for [email protected] |
The issued session token was confirmed usable: GET /api/v1/auths/ returned 200 authenticated as the victim. The provider log recorded the token as minted for client_id='attacker-evil-app', while Open WebUI's own client is openwebui-client-id.
Credits
Reported by @Classic298.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | open-webui | ≥ 0.8.0&&< 0.11.0 | 0.11.0pip install --upgrade 'open-webui==0.11.0' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for open-webui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update open-webui to 0.11.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rq84-p6rr-vf89 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-rq84-p6rr-vf89 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-rq84-p6rr-vf89. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-rq84-p6rr-vf89 in your dependencies?
O3 Security finds GHSA-rq84-p6rr-vf89 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.