[GHSA] GHSA-4qg5-cxx4-g927 (medium) — Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

GHSA-4qg5-cxx4-g927 Severity: medium CVE: CVE-2026-88005

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

## Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login call