Permalink
CVE-2025-15603
3.7 LOW
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt dismissed
open-webui JWT Key start_windows.bat random values
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start_windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI_SECRET_KEY leads to insufficiently random values. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
References
-
-
-
Submit #766444 | open-webui 6.16 Use of Hard-coded Cryptographic Key third-party-advisory
Affected products
open-webui
- ==0.6.9
- ==0.6.1
- ==0.6.15
- ==0.6.12
- ==0.6.7
- ==0.6.11
- ==0.6.5
- ==0.6.3
- ==0.6.10
- ==0.6.14
- ==0.6.6
- ==0.6.0
- ==0.6.2
- ==0.6.8
- ==0.6.13
- ==0.6.4
- ==0.6.16
Package maintainers
-
@drupol Pol Dellaiera <pol.dellaiera@protonmail.com>
-
@shivaraj-bh Shivaraj B H <sbh69840@gmail.com>