mirror of
https://github.com/open-webui/open-webui.git
synced 2026-07-21 17:29:50 -05:00
[GH-ISSUE #19823] Issue: MCP with OAuth 2.1 Authorization/Token retrival is broken in v0.6.41 #34538
Reference in New Issue
Block a user
Originally created by @mllab-nl on GitHub (Dec 8, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/19823
Check Existing Issues
Installation Method
Docker
Open WebUI Version
v0.6.41
Ollama Version (if applicable)
No response
Operating System
Docker Ubuntu
Browser (if applicable)
No response
Confirmation
README.md.Expected Behavior
High level behaviour is:
You can add a MCP tool with OAuth 2.1 and dynamic client registration
Conenction test is green.
You can save it.
When you try to enable it in a chat you are redirected for authorization.
When you authorize you get back to open-webui, but the too is still disabled
If you dig into the logs you see something like:
ERROR | open_webui.models.oauth_sessions:create_session:142 - Error creating OAuth session: (sqlite3.IntegrityError) NOT NULL constraint failed: oauth_session.expires_at
This happens becasue reqeust to token enpoint fails with 401, but is treated as a token. And that token doesn not have the expires_in property.
Why does it fail with 401?
When exchaning the code for a token open-web ui sends wrong client_id and client_secret.
If the registered client_id = "ID1" and client_secret = "PWD1" it will send:
client_id: "ID1,ID1"
client_secret: "PWD1,PWD1"
Which looks like the root cause of this and most likely other observed behaviours.
My guess would be that the authentication library will concatinate the ID and secret defiend in the Client with the additionaly passed ones.
See:
https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/backend/open_webui/utils/oauth.py#L747
Please also consider token refresh do avoid the same problem.
This initial flow did work in v0.6.39
Thank you !
Actual Behavior
You enable the MCP tool and is able to use it in the chat.
Steps to Reproduce
Described in expected
Logs & Screenshots
None
Additional Information
No response
@owui-terminator[bot] commented on GitHub (Dec 8, 2025):
🔍 Similar Issues Found
I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:
#19777 issue:
by Yaute7 • Dec 05, 2025 •
bug#15372 issue: v0.6.11 broke Authelia oauth
by zbejas • Jun 28, 2025 •
bug#17655 issue: Bug when refreshing tokens with oauth
by Clement44Ges • Sep 22, 2025 •
bug#16590 issue: OIDC SSO login broken after v0.6.19
by jakehlee • Aug 13, 2025 •
bug#19417 issue: v0.6.37 SQL Error
by AKHYP • Nov 24, 2025 •
bugShow 5 more related issues
#19496 issue: 500 internal server error appears in v0.6.40
by cloudtuotuo • Nov 26, 2025 •
bug#19563 issue:
by naruto7g • Nov 28, 2025 •
bug#18145 issue: 0.6.33 regression
by Ark-Levy • Oct 08, 2025 •
bug#19211 issue:
by Byrnes9 • Nov 16, 2025 •
bug#14529 issue: Open WebUI does not work on versions after version 0.6.7
by OpenSoftware-World • May 30, 2025 •
bug💡 Tips:
This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
@silentoplayz commented on GitHub (Dec 8, 2025):
Related - https://github.com/open-webui/open-webui/issues/19794
@tjbck commented on GitHub (Dec 11, 2025):
@mllab-nl Which mcp server are you using here?
@mllab-nl commented on GitHub (Dec 11, 2025):
@tjbck
The server is public, thus can be used for a test.
The logs are not public :)
https://todoapp.mllab.nl/mcp
You can log in to the app (https://todoapp.mllab.nl/readme) with any Google or Microsoft account and you can use the server.
If it works for you - it will work for other servers/users
@silentoplayz commented on GitHub (Dec 12, 2025):
Related - https://github.com/open-webui/open-webui/issues/19901
@Classic298 commented on GitHub (Dec 21, 2025):
should be fixed in dev