Dismissed
Permalink
CVE-2025-15603
3.7 LOW
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt dismissed
open-webui JWT Key start_windows.bat random values
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start_windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI_SECRET_KEY leads to insufficiently random values. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
References
- VDB-349701 | open-webui JWT Key start_windows.bat random values vdb-entry technical-description
- VDB-349701 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #766444 | open-webui 6.16 Use of Hard-coded Cryptographic Key third-party-advisory
- https://huntr.com/bounties/b9fc7fee-d25d-4100-9703-5e78a61e1ce4 exploit
Affected products
open-webui
- ==0.6.1
- ==0.6.15
- ==0.6.5
- ==0.6.10
- ==0.6.0
- ==0.6.2
- ==0.6.6
- ==0.6.16
- ==0.6.4
- ==0.6.7
- ==0.6.14
- ==0.6.11
- ==0.6.13
- ==0.6.3
- ==0.6.9
- ==0.6.8
- ==0.6.12
Package maintainers
-
@drupol Pol Dellaiera <pol.dellaiera@protonmail.com>
-
@shivaraj-bh Shivaraj B H <sbh69840@gmail.com>