PyPI/open-webui CVE-2026-88005: medium 6.5, EPSS 0.37%

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Action: Upgrade open-webui to 0.9.0 or later.

pip install open-webui==0.9.0

Affected

Fixed versions

Sources

• osv: GHSA-4qg5-cxx4-g927
• https://github.com/open-webui/open-webui/security/advisories/GHSA-4qg5-cxx4-g927
• https://github.com/open-webui/open-webui/pull/23639
• https://github.com/open-webui/open-webui/commit/fb5ef978bfb451c3f2221931e08e54250cec58ca
• https://github.com/open-webui/open-webui
• https://github.com/open-webui/open-webui/releases/tag/v0.9.0

CVE-2026-88005 · published 2026-09-10T15:09:20Z · modified 2026-10-01T17:56:19.737044182Z · JSON