CVE-2025-63391

Published December 18th, 2025

View on NVD ↗

CVSS v3

7.5

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

An authentication bypass vulnerability exists in Open-WebUI <=0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers.

open-webui/open-webui

User-friendly AI Interface (Supports Ollama, OpenAI API, ...)

GitHub

143K