CVE-2026-88005: Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI’s OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this endpoint.