Open WebUI CVE-2026-59219

Exploitation requires: (1) the Open WebUI deployment is configured with Redis (the revocation store that the vulnerable path fails to consult); (2) the attacker possesses a JWT that was validly issued to a real account and has since been revoked (via logout, forced-logout, or account disablement) but has not yet reached its natural expiry; and (3) network reachability to the Socket.IO connect/user-join/join-channels/join-note or terminal websocket endpoints. Limiting factors that reduce realistic risk: the attacker cannot forge tokens (JWT signature and expiry are still enforced by decode_token), so a completely unauthenticated outsider with no prior token cannot exploit this; deployments without Redis are outside the described condition; and the exploitation window closes when the token reaches its natural expiry. This is not a default-configuration remote-unauthenticated flaw - it is a revocation bypass that presumes prior legitimate token issuance.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N, score 7.1) indicates a network-reachable, low-complexity issue requiring low privileges - consistent with the need to possess a previously-issued (now revoked) JWT rather than to be fully unauthenticated. Real-world risk is moderate and conditional: exploitation is only possible on deployments that have Redis configured AND where a token has actually been revoked (e.g., after logout, credential rotation, or account disablement), so the attacker must already have held a legitimate session. There is no EPSS score, no SSVC record, and no POC or KEV entry in the supplied data, which points to a real but not urgent, non-wormable issue rather than a mass-exploitation threat. The primary consequence is continued unauthorized realtime access (confidentiality of chats/channels/notes and terminal websocket access) after access should have been cut off; the low integrity and null availability impacts limit blast radius. Note a nuance to verify with the vendor: Redis is an optional deployment component, so single-instance deployments without Redis are not affected in the manner described - this condition narrows the affected population.

An employee is offboarded and their Open WebUI session token is revoked, or a user logs out after suspecting compromise. Because the terminal/Socket.IO first-message check only decodes the JWT and skips the Redis revocation lookup, the attacker (holding the still-unexpired-but-revoked token) reconnects over the websocket and regains realtime access to channels, notes, and the terminal until the token naturally expires. No public POC is identified in the supplied data, but the attack is low-complexity given a valid revoked token.