CVE-2026-88006: Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI’s OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint.