Vulnerability in Open WebUI Affects Real-Time Connection Security
CVE-2026-59219

7.1HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
9 July 2026

What is CVE-2026-59219?

Open WebUI is a user-friendly self-hosted AI platform that has a vulnerability due to improper JWT handling in its real-time communication features. The flaw is present when Redis is configured, allowing users with revoked JWTs to maintain authentication for real-time socket connections. This issue arises from the failure to check the is_valid_token revocation for the decode_token process during specific websocket events. The vulnerability has been addressed in version 0.10.0, which enhances security by integrating proper revocation checks.

Affected Version(s)

open-webui >= 0.9.0, < 0.10.0

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM
https://github.com/open-webui/open-webui/commit/33b91bd8a...
x_refsource_MISC
https://github.com/open-webui/open-webui/releases/tag/v0....
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.