Open WebUI Windows installer generates low-entropy master key
Original title: Open WebUI: the Windows installer mints the master key from the install second — CVE-2025-15603 was rejected; here is the measurement
The Open WebUI Windows installer uses only the installation second as entropy for its master secret key that signs session tokens.
The source reports that Open WebUI's Windows installer (start_windows.bat) generates WEBUI_SECRET_KEY using the C rand() linear congruential generator seeded by installation time in seconds. This gives the key only one second of entropy. An attacker can recover the master key from any ordinary user's session token in approximately 2.1 seconds within a one-day window. The related CVE-2025-15603 was rejected but the measurement of the issue is provided.
Unconfirmed: CVE-2025-15603 was rejected; whether the issue was actually present remains unclear
- Key entropy limited to installation second
- Master key recoverable from user token in 2.1 seconds
- Affects only Windows installer
- Session token signing uses this key
Impact: Master key with one-second entropy allows blind token forgery
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-15603 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER | — | — |
From the original article
Posted by theknell on Nov 05 Open WebUI's Windows installer (start_windows. bat) generates WEBUI_SECRET_KEY — the master secret that signs every session token — from the C library's rand(), a linear congruential generator seeded once with the current time in seconds. The key's entire entropy is the second in which the software was installed.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.