CVE-2025-15603

Description

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start_windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI_SECRET_KEY leads to insufficiently random values. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.

References

https://vuldb.com/?submit.766444

https://vuldb.com/?id.349701

https://vuldb.com/?ctiid.349701

https://huntr.com/bounties/b9fc7fee-d25d-4100-9703-5e78a61e1ce4

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS