Posted by theknell— via Fulldisclosure on Nov 12
Open WebUI’s Windows installer (start_windows.bat) generates
WEBUI_SECRET_KEY — the master secret that signs every session token —
from the C library’s rand(), a linear congruential generator seeded
once with the current time in seconds. The key’s entire entropy is
the second in which the software was installed.
From any ordinary user’s own token, the master key is recoverable
blind in ~2.1 seconds across a ±1-day…
Source: Full Disclosure (seclists.org) · 2026-11-13