CVE-2026-59219: Open WebUI revoked JWTs bypass

Q: Is CVE-2026-59219 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-59219, increasing the risk of exploitation.

Q: How to fix CVE-2026-59219?

Upgrade to Open WebUI 0.10.0 immediately — it fixes the revocation check across all affected websocket handshakes (commit 33b91bd8, GHSA-855v-hq7w-jmjw). If immediate upgrade isn't possible, shorten JWT expiry/session TTL to reduce the exposure window, disable the terminal websocket feature for non-admin accounts, and force-restart the Open WebUI service after any credential revocation to drop live socket connections tied to the old token. For detection, review Redis-backed session and Socket.IO connection logs for sessions persisting past their known revocation timestamp, and flag terminal-websocket activity from recently offboarded or reset accounts.

Q: What systems are affected by CVE-2026-59219?

This vulnerability affects the following AI/ML architecture patterns: LLM chat UI platforms, realtime/collaborative AI interfaces, self-hosted AI deployments.

Q: What is the CVSS score for CVE-2026-59219?

CVE-2026-59219 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.46%.

CISO Take

Open WebUI's realtime layer — Socket.IO connections, channel and note joins, and the built-in terminal websocket — authenticated users by decoding their JWT without ever checking Redis's revocation list, so a token an admin explicitly revoked (logout-all, offboarding, incident response) kept working for live sessions until it naturally expired. This matters because it defeats the exact control CISOs rely on to cut off access fast: revoke a compromised or offboarded user's token and assume they're locked out, when in reality they can still ride a realtime connection into private channels, notes, and — if terminal access is enabled — a shell scoped to their prior permissions. The bug requires Redis-backed token storage (not every deployment uses this) and prior low-privilege authentication, and real-world urgency is dampened by an EPSS score of just 0.0025, no public exploit or Nuclei template, and no CISA KEV listing. Even so, with a mature, actively developed project (130 other CVEs on record) and full confidentiality impact (C:H) on any realtime data stream, self-hosted Open WebUI deployments should treat this as a priority patch, since silent revocation gaps are exactly what security teams don't monitor for. Upgrade to 0.10.0 immediately; until then, force-restart affected instances after any revocation event and shorten JWT/session TTLs to limit the exposure window.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS

What is the risk?

High severity (CVSS 7.1) driven by a full confidentiality breach (C:H) via a low-complexity, no-user-interaction network attack, but real-world risk is currently moderate: exploitation requires Redis-backed session storage plus a genuinely revoked-but-unexpired JWT already in the attacker's possession. EPSS sits at just 0.25% (84th percentile, not top-tier), there is no public exploit, no Nuclei template, and it is not in CISA KEV. The realistic threat actor is an insider, a departing employee, or a party who captured a token before it was revoked (stolen device, phished session) rather than an opportunistic remote scanner.

How does the attack unfold?

Token acquisition

Attacker obtains a valid JWT for a target Open WebUI account before it is revoked — via device compromise, phishing, or interception — and holds onto it as an application access token.

AML.T0091.000

Revocation event

The organization revokes the token (offboarding, incident response, or logout-all) expecting the Redis is_valid_token check to immediately invalidate any further use.

Websocket auth bypass

Attacker opens a raw Socket.IO connection and presents the revoked-but-unexpired JWT during connect/user-join/join-channels/join-note or the terminal websocket handshake; decode_token accepts it because the revocation check is never performed.

AML.T0049

Impact

Attacker reads private realtime channels and notes, and if the terminal websocket is enabled, executes commands with the victim account's permissions — despite the organization believing access was already revoked.

AML.T0025

Token acquisition

Attacker obtains a valid JWT for a target Open WebUI account before it is revoked — via device compromise, phishing, or interception — and holds onto it as an application access token.

AML.T0091.000

Revocation event

The organization revokes the token (offboarding, incident response, or logout-all) expecting the Redis is_valid_token check to immediately invalidate any further use.

Websocket auth bypass

Attacker opens a raw Socket.IO connection and presents the revoked-but-unexpired JWT during connect/user-join/join-channels/join-note or the terminal websocket handshake; decode_token accepts it because the revocation check is never performed.

AML.T0049

Impact

Attacker reads private realtime channels and notes, and if the terminal websocket is enabled, executes commands with the victim account's permissions — despite the organization believing access was already revoked.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.0, < 0.10.0	`0.10.0`
149.6K 4 dependents Pushed 3d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

Upgrade to Open WebUI 0.10.0 immediately — it fixes the revocation check across all affected websocket handshakes (commit 33b91bd8, GHSA-855v-hq7w-jmjw). If immediate upgrade isn't possible, shorten JWT expiry/session TTL to reduce the exposure window, disable the terminal websocket feature for non-admin accounts, and force-restart the Open WebUI service after any credential revocation to drop live socket connections tied to the old token. For detection, review Redis-backed session and Socket.IO connection logs for sessions persisting past their known revocation timestamp, and flag terminal-websocket activity from recently offboarded or reset accounts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Framework API AML.T0012 - Valid Accounts AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system operation and monitoring controls

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-59219?

Open WebUI's realtime layer — Socket.IO connections, channel and note joins, and the built-in terminal websocket — authenticated users by decoding their JWT without ever checking Redis's revocation list, so a token an admin explicitly revoked (logout-all, offboarding, incident response) kept working for live sessions until it naturally expired. This matters because it defeats the exact control CISOs rely on to cut off access fast: revoke a compromised or offboarded user's token and assume they're locked out, when in reality they can still ride a realtime connection into private channels, notes, and — if terminal access is enabled — a shell scoped to their prior permissions. The bug requires Redis-backed token storage (not every deployment uses this) and prior low-privilege authentication, and real-world urgency is dampened by an EPSS score of just 0.0025, no public exploit or Nuclei template, and no CISA KEV listing. Even so, with a mature, actively developed project (130 other CVEs on record) and full confidentiality impact (C:H) on any realtime data stream, self-hosted Open WebUI deployments should treat this as a priority patch, since silent revocation gaps are exactly what security teams don't monitor for. Upgrade to 0.10.0 immediately; until then, force-restart affected instances after any revocation event and shorten JWT/session TTLs to limit the exposure window.

Is CVE-2026-59219 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-59219, increasing the risk of exploitation.

How to fix CVE-2026-59219?

Upgrade to Open WebUI 0.10.0 immediately — it fixes the revocation check across all affected websocket handshakes (commit 33b91bd8, GHSA-855v-hq7w-jmjw). If immediate upgrade isn't possible, shorten JWT expiry/session TTL to reduce the exposure window, disable the terminal websocket feature for non-admin accounts, and force-restart the Open WebUI service after any credential revocation to drop live socket connections tied to the old token. For detection, review Redis-backed session and Socket.IO connection logs for sessions persisting past their known revocation timestamp, and flag terminal-websocket activity from recently offboarded or reset accounts.

What systems are affected by CVE-2026-59219?

This vulnerability affects the following AI/ML architecture patterns: LLM chat UI platforms, realtime/collaborative AI interfaces, self-hosted AI deployments.

What is the CVSS score for CVE-2026-59219?

CVE-2026-59219 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

LLM chat UI platformsrealtime/collaborative AI interfacesself-hosted AI deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This issue is fixed in version 0.10.0.

Exploitation Scenario

A security team detects a compromised laptop belonging to an Open WebUI user and immediately revokes that user's session token via the admin panel, assuming this cuts off access. The attacker, who already captured the JWT before revocation, opens a direct Socket.IO connection to the Open WebUI instance and presents the same now-revoked token during the connect/join-channels handshake. Because decode_token validates the JWT's signature and expiry but never checks the Redis is_valid_token revocation flag, the server accepts the connection as the victim user. The attacker now rides a live realtime session into the victim's private chat channels and notes, and — if the terminal websocket is enabled for that account — gains an interactive shell scoped to the victim's permissions, all while the security team believes access was already cut off.

Weaknesses (CWE)

CWE-613 Insufficient Session Expiration Primary CWE-613 Insufficient Session Expiration

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."