low3.7
CVE-2025-15603
Withdrawn Advisory: Open WebUI JWT Key Handler
Impact
### Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. ### Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start_windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI_SECRET_KEY leads to insufficiently random values. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | open-webui | <= 0.6.16 | none recorded |