EUVD-2026-42625
GHSA-855v-hq7w-jmjw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attacker must hold a validly-issued (revoked) token, so PR:L; network websocket reachability gives AV:N/AC:L; high confidentiality of realtime data, low integrity, no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This issue is fixed in version 0.10.0.
AnalysisAI
Session revocation bypass in Open WebUI 0.9.0 through 0.9.x (deployments configured with Redis) lets a holder of a revoked JWT keep authenticating realtime Socket.IO connections. The flaw stems from first-message authentication for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket calling decode_token without the Redis-backed is_valid_token revocation check, so logout, forced-logout, or token invalidation does not sever active realtime access. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the fix is version 0.10.0.
Technical ContextAI
Open WebUI is a self-hosted, extensible AI/LLM front-end that uses Socket.IO (WebSocket) for realtime features such as chat channels, note collaboration, and an interactive terminal. It authenticates these realtime sessions with JWTs. When configured with Redis, Open WebUI maintains a server-side allow/deny list of valid tokens (is_valid_token) so that revoked tokens can be rejected server-side. The vulnerable code path validated the JWT on the websocket first message using only decode_token, which checks the cryptographic signature and expiry of the JWT but does NOT consult the Redis-backed revocation store. This is a textbook CWE-613 (Insufficient Session Expiration / failure to invalidate sessions on the server side): the token remains cryptographically valid until its natural expiry even after the operator or user has explicitly revoked it, because the stateless check was substituted for the stateful revocation check on the realtime channel.
RemediationAI
Vendor-released patch: 0.10.0 - upgrade Open WebUI to version 0.10.0 or later, which restores the Redis-backed is_valid_token revocation check on the Socket.IO first-message authentication path (fix commit 33b91bd8ae8a100a5a306c91441a7d0b422c4cde, advisory GHSA-855v-hq7w-jmjw, release https://github.com/open-webui/open-webui/releases/tag/v0.10.0). If you cannot upgrade immediately, reduce exposure by shortening JWT lifetime so revoked tokens expire quickly (trade-off: more frequent re-authentication for users), rotating the JWT signing secret to forcibly invalidate all outstanding tokens (trade-off: this logs out all active users), and restricting network access to the Socket.IO/websocket endpoint to trusted networks or placing it behind an authenticating reverse proxy (trade-off: may break legitimate remote realtime clients). These are compensating controls only; upgrading to 0.10.0 is the definitive fix.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today