Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This issue is fixed in version 0.10.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
#CVE-2026-59219 - Authentication Bypass in Open #WebUI. Revoked JWTs allowed in realtime connections via #Redis. #CVSS 7.1. Update to v0.10.0 immediately. #CVEAlert #infosec #OpenWebUI #devsecops #devops #developers #sysadmin https://www.valtersit.com/cve/CVE-2026-59219
Post summary
An authentication bypass in Open WebUI allows use of revoked JWTs via Redis, and users should promptly upgrade to version 0.10.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |