DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59219: CVE-2026-59219: Session Revocation Bypass in Open WebUI Real-Time Endpoints

#security #cve #cybersecurity

CVE-2026-59219: Session Revocation Bypass in Open WebUI Real-Time Endpoints

Vulnerability ID: CVE-2026-59219
CVSS Score: 7.1
Published: 2026-07-24

CVE-2026-59219 identifies a session-revocation bypass vulnerability in Open WebUI versions 0.9.0 through 0.9.99. While standard HTTP REST endpoints enforce stateful JWT revocation using a Redis-backed blacklist, WebSocket and Socket.IO endpoints bypassed these checks. Consequently, a token revoked via sign-out or OIDC logout remains valid for establishing real-time communication channels and accessing server terminal proxies.

TL;DR

Open WebUI's Socket.IO and terminal WebSocket interfaces validated JWT signatures but bypassed stateful Redis revocation checks. This allowed logged-out or blacklisted user sessions to persist and access real-time endpoints and administrative terminal proxies.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-613: Insufficient Session Expiration
  • Attack Vector: Network
  • CVSS: 7.1 (High)
  • EPSS: 0.00305 (Percentile: 22.66%)
  • Impact: Session Bypass / Unauthorized Real-time and Terminal Access
  • Exploit Status: PoC Analyzed
  • KEV Status: Not Listed

Affected Systems

  • Open WebUI
  • Open WebUI: >= 0.9.0, < 0.10.0 (Fixed in: 0.10.0)

Code Analysis

Commit: 33b91bd

Refactor token validation to check Redis revocation blacklist in WebSocket and Socket.IO handshakes.

Mitigation Strategies

  • Upgrade Open WebUI to version 0.10.0 or higher to enforce stateful JWT revocation on WebSocket handshakes.
  • Configure a shorter JWT lifetime using the JWT_EXPIRY configuration variable to limit the session reuse window.
  • Disable host terminal services if proxy console access is not required for standard operations.

Remediation Steps:

  1. Pull the latest container image from ghcr.io/open-webui/open-webui:main or download release 0.10.0.
  2. Re-deploy the container ensuring that the Redis environment configurations match the target cluster state.
  3. Verify the WebSocket connections on /ws/socket.io return error codes for revoked token attempts.

References

Read the full report for CVE-2026-59219 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)