Low severityNVD Advisory· Published Mar 9, 2026· Updated Jun 18, 2026
CVE-2025-15603
CVE-2025-15603
Description
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and open-webui serve all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key)."
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | <= 0.6.16 | — |
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-2rf6-9rc8-rqchghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-15603ghsaADVISORY
- huntr.com/bounties/b9fc7fee-d25d-4100-9703-5e78a61e1ce4ghsaWEB
- vuldb.comghsaWEB
- vuldb.comghsaWEB
- vuldb.comghsaWEB
News mentions
0No linked articles in our index yet.