← Back

CVE-2026-59219

nvd nist
Published: Jul 9, 2026Modified: Jul 10, 2026

JSON object

Loading...
7.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Exploitability: 2.8 / Impact: 4.2
Source: security-advisories@github.com (Secondary)

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This issue is fixed in version 0.10.0.

Affected (1)

Openwebui
1 product
Open Webui
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Open Webui
From 0.9.0 to 0.10.0

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
MitigationVendor AdvisoryExploit
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
MitigationVendor AdvisoryExploit

Timeline

No history available yet.