CVE-2025-15603: Open WebUI JWT Key Handler Insufficient Randomness Vulnerability
Summary
CVE-2025-15603: Withdrawn Advisory: Open WebUI JWT Key Handler. Affects open-webui versions < 0.6.16. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is an open-source web user interface framework designed for building web applications. It provides a set of tools and libraries that facilitate the development of user interfaces with a focus on modularity and ease of use. The framework includes various components, one of which is the JWT Key Handler, responsible for managing JSON Web Tokens (JWT) for secure authentication. However, versions up to 0.6.16 of Open WebUI have been found to be vulnerable due to insufficient randomness in the generation of secret keys, potentially compromising the security of applications using this framework.
Vulnerability Detail
The vulnerability arises from a flaw in the JWT Key Handler's handling of the WEBUI_SECRET_KEY argument in the backend/start_windows.bat file. This manipulation can lead to insufficiently random values being generated for the secret key, which is critical for the security of JWTs. An attacker could exploit this vulnerability remotely, although the complexity of the attack is high, making it difficult to execute. The exploit has been publicly disclosed, raising concerns about its potential use in real-world scenarios, particularly for applications relying on JWT for authentication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using a different method for generating secret keys that ensures sufficient randomness. For example, you can manually set a strong random key in your application configuration instead of relying on the default behavior. Here is a sample code snippet to set a secure key:
import os WEBUI_SECRET_KEY = os.urandom(24).hex()
Conclusion
In summary, the Open WebUI framework has a vulnerability related to insufficient randomness in its JWT Key Handler, affecting versions up to 0.6.16. Users are advised to update to a patched version to secure their applications. For those unable to update immediately, a workaround is available to mitigate the risk.
See every vulnerability recorded for open-webui →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to generate predictable JWTs, leading to unauthorized access to user accounts and sensitive data.
Yes, updating to a version of Open WebUI beyond 0.6.16 will address the vulnerability.
If an immediate update is not possible, implement a strong random key generation method as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
