Skip to content
Threat Feed
Subscribe

Product

Open WebUI (>= 0.9.0, < 0.10.0)

1 brief RSS
high advisory

Open WebUI: Realtime Endpoints Fail to Revoke JWTs

Open WebUI versions from 0.9.0 to before 0.10.0, when configured with Redis, fail to correctly enforce JWT revocation for realtime authentication endpoints such as Socket.IO and terminal websockets, allowing attackers to maintain access to real-time features with stolen, revoked JWTs.

Open WebUI vulnerability jwt authentication webui realtime bypass
1t 1c