[GH-ISSUE #19823] Issue: MCP with OAuth 2.1 Authorization/Token retrival is broken in v0.6.41 #138736

Closed
opened 2026-05-25 11:29:32 -05:00 by GiteaMirror · 6 comments
Owner

Originally created by @mllab-nl on GitHub (Dec 8, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/19823

Check Existing Issues

  • I have searched for any existing and/or related issues.
  • I have searched for any existing and/or related discussions.
  • I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.41

Ollama Version (if applicable)

No response

Operating System

Docker Ubuntu

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

High level behaviour is:
You can add a MCP tool with OAuth 2.1 and dynamic client registration
Conenction test is green.
You can save it.

When you try to enable it in a chat you are redirected for authorization.
When you authorize you get back to open-webui, but the too is still disabled

If you dig into the logs you see something like:
ERROR | open_webui.models.oauth_sessions:create_session:142 - Error creating OAuth session: (sqlite3.IntegrityError) NOT NULL constraint failed: oauth_session.expires_at

This happens becasue reqeust to token enpoint fails with 401, but is treated as a token. And that token doesn not have the expires_in property.

Why does it fail with 401?
When exchaning the code for a token open-web ui sends wrong client_id and client_secret.
If the registered client_id = "ID1" and client_secret = "PWD1" it will send:
client_id: "ID1,ID1"
client_secret: "PWD1,PWD1"

Which looks like the root cause of this and most likely other observed behaviours.
My guess would be that the authentication library will concatinate the ID and secret defiend in the Client with the additionaly passed ones.
See:
https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/backend/open_webui/utils/oauth.py#L747

Please also consider token refresh do avoid the same problem.

This initial flow did work in v0.6.39
Thank you !

Actual Behavior

You enable the MCP tool and is able to use it in the chat.

Steps to Reproduce

Described in expected

Logs & Screenshots

None

Additional Information

No response

Originally created by @mllab-nl on GitHub (Dec 8, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/19823 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.41 ### Ollama Version (if applicable) _No response_ ### Operating System Docker Ubuntu ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior High level behaviour is: You can add a MCP tool with OAuth 2.1 and dynamic client registration Conenction test is green. You can save it. When you try to enable it in a chat you are redirected for authorization. When you authorize you get back to open-webui, but the too is still disabled If you dig into the logs you see something like: ERROR | open_webui.models.oauth_sessions:create_session:142 - Error creating OAuth session: (sqlite3.IntegrityError) NOT NULL constraint failed: oauth_session.expires_at This happens becasue reqeust to token enpoint fails with 401, but is treated as a token. And that token doesn not have the expires_in property. Why does it fail with 401? When exchaning the code for a token open-web ui sends wrong client_id and client_secret. If the registered client_id = "ID1" and client_secret = "PWD1" it will send: client_id: "ID1,ID1" client_secret: "PWD1,PWD1" Which looks like the root cause of this and most likely other observed behaviours. My guess would be that the authentication library will concatinate the ID and secret defiend in the Client with the additionaly passed ones. See: https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/backend/open_webui/utils/oauth.py#L747 Please also consider token refresh do avoid the same problem. This initial flow did work in [v0.6.39](https://github.com/open-webui/open-webui/releases/tag/v0.6.39) Thank you ! ### Actual Behavior You enable the MCP tool and is able to use it in the chat. ### Steps to Reproduce Described in expected ### Logs & Screenshots None ### Additional Information _No response_
GiteaMirror added the bug label 2026-05-25 11:29:32 -05:00
Author
Owner

@owui-terminator[bot] commented on GitHub (Dec 8, 2025):

🔍 Similar Issues Found

I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:

  1. #19777 issue:
    by Yaute7 • Dec 05, 2025 • bug

  2. #15372 issue: v0.6.11 broke Authelia oauth
    by zbejas • Jun 28, 2025 • bug

  3. #17655 issue: Bug when refreshing tokens with oauth
    by Clement44Ges • Sep 22, 2025 • bug

  4. #16590 issue: OIDC SSO login broken after v0.6.19
    by jakehlee • Aug 13, 2025 • bug

  5. #19417 issue: v0.6.37 SQL Error
    by AKHYP • Nov 24, 2025 • bug

Show 5 more related issues
  1. #19496 issue: 500 internal server error appears in v0.6.40
    by cloudtuotuo • Nov 26, 2025 • bug

  2. #19563 issue:
    by naruto7g • Nov 28, 2025 • bug

  3. #18145 issue: 0.6.33 regression
    by Ark-Levy • Oct 08, 2025 • bug

  4. #19211 issue:
    by Byrnes9 • Nov 16, 2025 • bug

  5. #14529 issue: Open WebUI does not work on versions after version 0.6.7
    by OpenSoftware-World • May 30, 2025 • bug


💡 Tips:

  • If this is a duplicate, please consider closing this issue and adding any additional details to the existing one
  • If you found a solution in any of these issues, please share it here to help others

This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.

<!-- gh-comment-id:3627609213 --> @owui-terminator[bot] commented on GitHub (Dec 8, 2025): 🔍 **Similar Issues Found** I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions: 1. [#19777](https://github.com/open-webui/open-webui/issues/19777) **issue:** *by Yaute7 • Dec 05, 2025 • `bug`* 2. [#15372](https://github.com/open-webui/open-webui/issues/15372) **issue: v0.6.11 broke Authelia oauth** *by zbejas • Jun 28, 2025 • `bug`* 3. [#17655](https://github.com/open-webui/open-webui/issues/17655) **issue: Bug when refreshing tokens with oauth** *by Clement44Ges • Sep 22, 2025 • `bug`* 4. [#16590](https://github.com/open-webui/open-webui/issues/16590) **issue: OIDC SSO login broken after v0.6.19** *by jakehlee • Aug 13, 2025 • `bug`* 5. [#19417](https://github.com/open-webui/open-webui/issues/19417) **issue: v0.6.37 SQL Error** *by AKHYP • Nov 24, 2025 • `bug`* <details> <summary>Show 5 more related issues</summary> 6. [#19496](https://github.com/open-webui/open-webui/issues/19496) **issue: 500 internal server error appears in v0.6.40** *by cloudtuotuo • Nov 26, 2025 • `bug`* 7. [#19563](https://github.com/open-webui/open-webui/issues/19563) **issue:** *by naruto7g • Nov 28, 2025 • `bug`* 8. [#18145](https://github.com/open-webui/open-webui/issues/18145) **issue: 0.6.33 regression** *by Ark-Levy • Oct 08, 2025 • `bug`* 9. [#19211](https://github.com/open-webui/open-webui/issues/19211) **issue:** *by Byrnes9 • Nov 16, 2025 • `bug`* 10. [#14529](https://github.com/open-webui/open-webui/issues/14529) **issue: Open WebUI does not work on versions after version 0.6.7** *by OpenSoftware-World • May 30, 2025 • `bug`* </details> --- 💡 **Tips:** - If this is a duplicate, please consider closing this issue and adding any additional details to the existing one - If you found a solution in any of these issues, please share it here to help others *This comment was generated automatically by a bot.* Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
Author
Owner

@silentoplayz commented on GitHub (Dec 8, 2025):

Related - https://github.com/open-webui/open-webui/issues/19794

<!-- gh-comment-id:3628550271 --> @silentoplayz commented on GitHub (Dec 8, 2025): Related - https://github.com/open-webui/open-webui/issues/19794
Author
Owner

@tjbck commented on GitHub (Dec 11, 2025):

@mllab-nl Which mcp server are you using here?

<!-- gh-comment-id:3643387053 --> @tjbck commented on GitHub (Dec 11, 2025): @mllab-nl Which mcp server are you using here?
Author
Owner

@mllab-nl commented on GitHub (Dec 11, 2025):

@tjbck
The server is public, thus can be used for a test.
The logs are not public :)
https://todoapp.mllab.nl/mcp
You can log in to the app (https://todoapp.mllab.nl/readme) with any Google or Microsoft account and you can use the server.
If it works for you - it will work for other servers/users

<!-- gh-comment-id:3643979779 --> @mllab-nl commented on GitHub (Dec 11, 2025): @tjbck The server is public, thus can be used for a test. The logs are not public :) https://todoapp.mllab.nl/mcp You can log in to the app (https://todoapp.mllab.nl/readme) with any Google or Microsoft account and you can use the server. If it works for you - it will work for other servers/users
Author
Owner

@silentoplayz commented on GitHub (Dec 12, 2025):

Related - https://github.com/open-webui/open-webui/issues/19901

<!-- gh-comment-id:3644741708 --> @silentoplayz commented on GitHub (Dec 12, 2025): Related - https://github.com/open-webui/open-webui/issues/19901
Author
Owner

@Classic298 commented on GitHub (Dec 21, 2025):

should be fixed in dev

<!-- gh-comment-id:3678957126 --> @Classic298 commented on GitHub (Dec 21, 2025): should be fixed in dev
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#138736