CVE-2025-15603: open-webui JWT Key start_windows.bat random values
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, startwindows.bat and open-webui serve all set or auto-generate WEBUISECRETKEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key)."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
open-webui (JWT Key Handler)from your environment.If the JWT Key Handler or the use of backend/start_windows.bat is not required, remove or disable this component (or avoid using the startup script) to eliminate the vulnerable code path.
- Configuration
Do not pass WEBUI_SECRET_KEY via command-line arguments or allow external manipulation. Configure WEBUI_SECRET_KEY using a securely generated, high-entropy secret (use a cryptographic RNG) and store it in a protected location such as a secrets manager or protected environment variable. Ensure the startup script does not reduce entropy when accepting this value.
open-webui (JWT Key Handler — backend/start_windows.bat) WEBUI_SECRET_KEY = cryptographically secure random secret (do not derive from or accept untrusted input) - Compensating control
Restrict remote access to the service and management interfaces to trusted IPs or networks using firewall rules, network ACLs, or a WAF to reduce the risk of remote exploitation.
- Operational
Rotate any existing WEBUI_SECRET_KEY and any JWT signing keys that may have been created or exposed. Generate new keys using a cryptographically secure random generator and redeploy services using the new secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15603?
CVE-2025-15603 has been categorized with a critical severity level due to the potential for unauthorized access through weak JWT key management.
How do I fix CVE-2025-15603?
To fix CVE-2025-15603, update open-webui to version 0.6.17 or later to ensure proper handling of the WEBUI_SECRET_KEY.
What versions of open-webui are affected by CVE-2025-15603?
CVE-2025-15603 affects all versions of open-webui up to and including 0.6.16.
What component is vulnerable in CVE-2025-15603?
The vulnerability in CVE-2025-15603 is found in the JWT Key Handler component, specifically within the backend/start_windows.bat file.
What are the potential risks associated with CVE-2025-15603?
The risks associated with CVE-2025-15603 include the possibility of unauthorized access and manipulation of JWT keys, compromising the security of the application.