What is the CVSS score of EUVD-2026-42623?

EUVD-2026-42623 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-42623?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42623. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-42623?

Yes, a patch is available for EUVD-2026-42623. Update the affected software to the latest version immediately.

Open WebUI EUVD-2026-42623

| CVE-2026-59715 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-09 GitHub_M

GHSA-gmfw-g93r-vg53

Authentication Bypass Open Webui

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

LOW

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.7 LOW

Handlers explicitly require no authentication per the advisory (PR:N), but AC:H reflects that useful exploitation requires knowing active document session identifiers unavailable to a blind external attacker.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Jul 10, 2026 - 02:52 NVD

LOW MEDIUM

CVSS changed

Jul 10, 2026 - 02:52 NVD

3.1 (LOW) 6.5 (MEDIUM)

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:19 vuln.today

DescriptionNVD

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.

AnalysisAI

Unauthenticated manipulation of collaborative document state is possible in Open WebUI versions 0.6.16 through 0.9.x, where the Socket.IO server's always_connect=True configuration allows the ydoc:awareness:update and ydoc:document:leave event handlers to process requests from any connected client regardless of identity. An attacker with network access to the platform can inject false collaborative presence data or trigger spurious document-leave events, disrupting active collaboration sessions for legitimate users. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the input.

Technical ContextAI

Open WebUI's real-time collaborative editing is built on the Yjs CRDT framework, transmitted over Socket.IO. The always_connect=True server setting bypasses the typical authentication gate that would reject unauthenticated persistent event streams. The two vulnerable handlers - ydoc:awareness:update (used to broadcast cursor position and user-presence information among collaborators) and ydoc:document:leave (fired when a participant exits a shared document) - accept and process events from any connected socket, authenticated or not. CWE-306 (Missing Authentication for Critical Function) precisely describes the root cause: these handlers modify shared collaborative state without verifying the caller's identity, despite other platform endpoints enforcing authentication. The affected CPE is cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade Open WebUI to version 0.10.0 or later; the fix was introduced in commit 22f2fe1ffb66c993dad1e0b2b35514acaed2370e via pull request #25946 and the patched release is available at https://github.com/open-webui/open-webui/releases/tag/v0.10.0. If immediate upgrade is not possible, restrict network access to the Socket.IO endpoint (typically served on the same port as the WebUI, e.g., 8080) to trusted, authenticated networks only via firewall or reverse-proxy ACL - this reduces external exposure but does not fix the underlying authentication gap and still leaves insider threats unmitigated. Disabling collaborative document features entirely (if not operationally required) is a stronger compensating control; however, the specific configuration toggle is not documented in the advisory. No additional workarounds are identified in the available references.