[PR #23639] [MERGED] fix: enforce OAUTH_ALLOWED_DOMAINS on token exchange endpoint #50344

New Issue

GiteaMirror · 2026-04-30T03:01:17-05:00

GiteaMirror commented

2026-04-30 03:01:17 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23639
Author: @Classic298
Created: 4/12/2026
Status: ✅ Merged
Merged: 4/12/2026
Merged by: @tjbck

Base: dev ← Head: fix/oauth-token-exchange-domain-bypass

📝 Commits (1)

ed22119 fix: enforce OAUTH_ALLOWED_DOMAINS on token exchange endpoint

📊 Changes

1 file changed (+12 additions, -0 deletions)

View changed files

📝 backend/open_webui/routers/auths.py (+12 -0)

📄 Description

The OAuth token exchange endpoint skipped the domain allowlist check that the normal OAuth callback enforces. An attacker with a valid OAuth token from a non-allowed domain (e.g. gmail.com) could bypass the admin's domain restriction policy entirely.

Adds the same domain validation check used in the OAuth callback, denying access when the email domain is not in the allowed list.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23639 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 4/12/2026 **Status:** ✅ Merged **Merged:** 4/12/2026 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `fix/oauth-token-exchange-domain-bypass` --- ### 📝 Commits (1) - [`ed22119`](https://github.com/open-webui/open-webui/commit/ed22119f471e5bafdb10a3e94a3f68dd7f1d7b6c) fix: enforce OAUTH_ALLOWED_DOMAINS on token exchange endpoint ### 📊 Changes **1 file changed** (+12 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/auths.py` (+12 -0) </details> ### 📄 Description The OAuth token exchange endpoint skipped the domain allowlist check that the normal OAuth callback enforces. An attacker with a valid OAuth token from a non-allowed domain (e.g. gmail.com) could bypass the admin's domain restriction policy entirely. Adds the same domain validation check used in the OAuth callback, denying access when the email domain is not in the allowed list. ### Contributor License Agreement  - [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-30 03:01:17 -05:00

GiteaMirror closed this issue

2026-04-30 03:01:22 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#50344