PT-2026-24109 · Unknown · Open-Webui

I4M6Da · Publicado 2026-03-09 · Atualizado 2026-03-09 · CVE-2025-15603

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions open-webui versions prior to 0.6.16

Description A security issue exists in open-webui. The JWT Key Handler component contains a weakness related to insufficiently random values generated due to manipulation of the WEBUI SECRET KEY argument within the file backend/start windows.bat. This allows for remote attacks, though exploitation is considered difficult and requires a high level of complexity. The exploit has been publicly disclosed.

Recommendations Update to a version of open-webui greater than 0.6.16.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-310

CWE-330

Identificadores relacionados

CVE-2025-15603

Produtos afetados

Open-Webui

Referências · 7

• 🔥 https://huntr.com/bounties/b9fc7fee-d25d-4100-9703-5e78a61e1ce4 · Exploit
• https://vuldb.com/?id.349701 · Nota
• https://twitter.com/VulmonFeeds/status/2031148960413294690 · Publicação no Twitter
• https://vuldb.com/?submit.766444 · Nota
• https://vuldb.com/?ctiid.349701 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15603 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031122515922223339 · Publicação no Twitter