CVE-2026-70482 is a high severity (CVSS 8.1) authentication flaw in Open WebUI from 0.8.0 until 0.11.0. When ENABLE_OAUTH_TOKEN_EXCHANGE is true, the token exchange endpoint accepts a provider token issued to any client. The fix is Open WebUI 0.11.0, and the setting is off by default.
What's affected
Open WebUI (pip package open-webui) from 0.8.0 up to but not including 0.11.0, fixed in 0.11.0, according to the GitHub advisory, which also rates it 8.1 high.
The weakness is CWE-287, improper authentication. With ENABLE_OAUTH_TOKEN_EXCHANGE set to true, the /oauth/provider/token/exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo call tells you a token is valid, not which OAuth client it was issued to, and the endpoint did no client check of its own.
The advisory lists preconditions. The setting is disabled by default, so a stock install is not affected. The victim must already have an account, since the endpoint does not create users. The attacker needs an access token for the victim from another application on the same provider. Providers that issue a stable subject across clients, such as Google, GitHub, Okta and default self-hosted OIDC, are directly affected. Microsoft Entra ID issues per-application subjects, so matching fails there unless OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled or OAUTH_SUB_CLAIM points at a globally stable claim.
How to check if you're exposed
First check the version:
pip show open-webui | grep -i '^version'
For Docker, read the image tag. Then check the setting. Look in your environment or deployment config for ENABLE_OAUTH_TOKEN_EXCHANGE:
env | grep ENABLE_OAUTH_TOKEN_EXCHANGE
If it is unset or false, this CVE does not apply to your deployment, but upgrading is still sensible. If it is true and you are on 0.8.0 to 0.10.x, treat the instance as exposed.
Also check which provider you use and whether OAUTH_MERGE_ACCOUNTS_BY_EMAIL or OAUTH_SUB_CLAIM are set, since the advisory says these change whether the subject match succeeds. free in-browser dependency scan checks package manifests for known vulnerabilities.
What to do now
- Check your Open WebUI version and whether ENABLE_OAUTH_TOKEN_EXCHANGE is true.
- Upgrade to 0.11.0 or later.
- If you cannot upgrade, turn token exchange off.
- Review sign in logs for sessions created through the token exchange endpoint.
- If you run Entra ID, review OAUTH_MERGE_ACCOUNTS_BY_EMAIL and OAUTH_SUB_CLAIM, as the advisory describes.
Why it matters
CWE-287 here is a confused deputy problem. The server asks the provider whether a token is real, but a real token for a different application is still a real token. Without checking the audience, it cannot tell whether the token was meant for it.
Audience checks are a standard part of token validation in OAuth and OIDC. Any endpoint that turns an external token into a local session must verify who the token was issued for. The attack is not exotic, but it needs the right setting and conditions, which is why the default being off matters.
Quick check
Is a default install affected?
No. The advisory says ENABLE_OAUTH_TOKEN_EXCHANGE is disabled by default, so a stock deployment is not affected. Check your configuration to be sure.
Sources
Last reviewed: 18 October 2026.
