PT-2026-24109 · Unknown · Open-Webui

I4M6Da · Published 2026-03-09 · Updated 2026-03-09 · CVE-2025-15603

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions open-webui versions prior to 0.6.16

Description A security issue exists in open-webui. The JWT Key Handler component contains a weakness related to insufficiently random values generated due to manipulation of the WEBUI SECRET KEY argument within the file backend/start windows.bat. This allows for remote attacks, though exploitation is considered difficult and requires a high level of complexity. The exploit has been publicly disclosed.

Recommendations Update to a version of open-webui greater than 0.6.16.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-310

CWE-330

Related Identifiers

CVE-2025-15603

Affected Products

Open-Webui

References · 7

• 🔥 https://huntr.com/bounties/b9fc7fee-d25d-4100-9703-5e78a61e1ce4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15603 · Security Note
• https://vuldb.com/?id.349701 · Note
• https://twitter.com/VulmonFeeds/status/2031148960413294690 · Twitter Post
• https://vuldb.com/?submit.766444 · Note
• https://vuldb.com/?ctiid.349701 · Note
• https://twitter.com/CVEnew/status/2031122515922223339 · Twitter Post