CVE-2025-15603— open-webui JWT Key start_windows.bat random values
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-15603
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
open-webui JWT Key start_windows.bat random values
Source: NVD (National Vulnerability Database)
Vulnerability Description
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start_windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI_SECRET_KEY leads to insufficiently random values. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用不充分的随机数
Source: NVD (National Vulnerability Database)
Vulnerability Title
Open WebUI 安全特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open WebUI是Open WebUI开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.6.16及之前版本存在安全特征问题漏洞，该漏洞源于对参数WEBUI_SECRET_KEY的操作导致随机性不足。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | open-webui | 0.6.0 | - |
II. Public POCs for CVE-2025-15603
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-15603
请登录查看更多情报信息。
- Submit #766444: open-webui 6.16 Use of Hard-coded Cryptographic Keythird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-15603
Same Patch Batch · n/a · 2026-03-09 · 25 CVEs total
| CVE-2025-70060 | Sean1025 YMFE YApi 安全漏洞 | |
| CVE-2025-70028 | sunbird-portal 安全漏洞 | |
| CVE-2025-70973 | Sensorweb ScadaBR 安全漏洞 | |
| CVE-2025-70030 | sunbird-portal 安全漏洞 | |
| CVE-2025-70031 | sunbird-portal 安全漏洞 | |
| CVE-2025-70032 | sunbird-portal 安全漏洞 | |
| CVE-2026-30140 | Tenda W15E 安全漏洞 | |
| CVE-2025-70033 | sunbird-portal 安全漏洞 | |
| CVE-2025-70039 | Twake 安全漏洞 | |
| CVE-2025-70038 | Twake 安全漏洞 | |
| CVE-2025-70034 | SSH2 安全漏洞 | |
| CVE-2025-70037 | Twake 安全漏洞 | |
| CVE-2025-70059 | Sean1025 YMFE YApi 安全漏洞 | |
| CVE-2025-70040 | JiMeng Web MCP Server 安全漏洞 | |
| CVE-2025-70047 | Nexus Wallet Interface 安全漏洞 | |
| CVE-2025-70042 | ThermaKube 安全漏洞 | |
| CVE-2025-70050 | LessPass 安全漏洞 | |
| CVE-2025-70046 | OA-System 安全漏洞 | |
| CVE-2025-70048 | Nexus Wallet Interface 安全漏洞 | |
| CVE-2025-69647 | GNU BinUtils 安全漏洞 |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: open-webui
- CVE-2026-34225
Open WebUI has Blind Server Side Request Forgery in its Imag - CVE-2026-34222
Open WebUI has Broken Access Control in Tool Valves - CVE-2026-29071
Open WebUI's Insecure Direct Object Reference (IDOR) allows - CVE-2026-29070
Open WebUI has unauthorized deletion of knowledge files - CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownershi
Same vendor: n/a
- CVE-2026-8276
bettercap MySQL Server mysql_server.go integer coercion - CVE-2026-8275
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippR - CVE-2026-8270
Open5GS SMF ogs_nas_parse_qos_rules denial of service - CVE-2026-8269
Open5GS SMF smf_nsmf_handle_create_sm_context denial of serv - CVE-2026-8268
Open5GS SMF OpenAPI_list_create denial of service
Same weakness: CWE-330
- CVE-2026-7847
chatchat-space Langchain-Chatchat Uploaded File openai_route - CVE-2026-40975
VMware Spring Boot 安全特征问题漏洞 - CVE-2026-40496
FreeScout has Predictable Attachment Token that Allows Unaut - CVE-2026-40306
DNN has same HostGUID for all new installs - CVE-2026-33710
Chamilo LMS has Weak REST API Key Generation (Predictable)
V. Comments for CVE-2025-15603
No comments yet