CVE-2025-15603 open-webui JWT Key start_windows.bat random values

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...

CVE-2025-15603

The CVE affects open-webui up to 0.6.16, specifically the JWT Key Handler’s file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY can produce insufficiently random values, enabling a remote attack. Exploitability is rated high complexity with no authentication required; impact shown a...