{
 "id": "AIR-2026-0050",
 "slug": "cve-2026-70482-open-webui-insecure-oauth-token-exchange-vuln",
 "title": "CVE-2026-70482: Open WebUI insecure OAuth token exchange vulnerability",
 "summary": "Between versions 0.8.0 and 0.11.0, Open WebUI accepted raw provider access tokens without verifying the issuing OAuth client when token exchange was enabled. This allowed session creation using tokens minted for other clients.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-08-04",
 "incident_date_precision": "day",
 "first_reported": "2026-08-04",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70482",
   "publisher": "NVD",
   "title": "CVE-2026-70482: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.",
   "published_at": "2026-08-04"
  },
  {
   "url": "https://github.com/advisories/GHSA-rq84-p6rr-vf89",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-70482: Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client",
   "published_at": "2026-08-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-70482",
  "open-webui",
  "oauth"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}