open-webui up to 0.6.16 JWT Key env.py WEBUI_SECRET_KEY random values 🚫 [False Positive]

Noticeinfo

⚠️ This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key)."

Productinfo

Name

• open-webui

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4
• 0.6.5
• 0.6.6
• 0.6.7
• 0.6.8
• 0.6.9
• 0.6.10
• 0.6.11
• 0.6.12
• 0.6.13
• 0.6.14
• 0.6.15
• 0.6.16

License

• open-source

Website

• Product: https://github.com/open-webui/open-webui/

Timelineinfo

03/07/2026 Advisory disclosed
03/07/2026 +0 days VulDB entry created
06/18/2026 +103 days VulDB entry last update

Sourcesinfo

Product: github.com

Advisory: huntr.com
False Positive: Yes
Disputed: 🔍

CVE: CVE-2025-15603 (🔒)
GCVE (CVE): GCVE-0-2025-15603
GCVE (VulDB): GCVE-100-349701
scip Labs: https://www.scip.ch/en/?labs.20161013

Entryinfo

Created: 03/07/2026 18:32
Updated: 06/18/2026 07:52
Changes: 03/07/2026 18:32 (55), 03/12/2026 23:55 (31), 06/18/2026 07:52 (13)
Complete: 🔍
Submitter: I4m6da
Cache ID: 216::103

Submitinfo

Accepted

• Submit #766444: open-webui 6.16 Use of Hard-coded Cryptographic Key (by I4m6da)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion

Want to know what is going to be exploited?

We predict KEV entries!