https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:16:10.620696+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59219 CVE-2026-59219 — Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout 2026-10-07T00:16:10.636174+00:00

Affected: open-webui

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This issue is fixed in version 0.10.0.