Intelligence View
⚡ tsecurity.de Intelligence
CVE-2025-15603 | open-webui up to 0.6.16 JWT Key env.py WEBUI_SECRET_KEY random values
This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh,…
Reagiere als Erste:r — dein Feedback zählt!
This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key)."
SOCIAL SHARE CARD GENERATOR