Open WebUI vulnerability enables account takeover via JWT token theft
Researchers discovered a high-severity vulnerability in Open WebUI (CVE-2025-64496) that allows attackers to steal JWT authentication tokens and take over user accounts when the Direct Connections feature is enabled. If the compromised account has elevated permissions, the vulnerability can lead to remote code execution on the backend server.
What happened
A high-severity vulnerability in Open WebUI (CVE-2025-64496) affecting versions 0.6.34 and older allows attackers to steal JWT authentication tokens stored in localStorage via crafted server-sent events messages sent through the Direct Connections feature.
The Direct Connections feature allows users to link Open WebUI to external, OpenAI-compatible model servers. An attacker can trick a victim into connecting to a malicious server posing as a legitimate AI endpoint.
Reported impact
Successful exploitation grants attackers full access to the victim's Open WebUI account, exposing chats, uploaded documents, and API keys. If the compromised account has workspace.tools permissions, attackers can execute arbitrary Python code on the backend server without sandboxing or validation, enabling full remote code execution.
Index analysis
The vulnerability stems from a trust failure between untrusted model servers and the user's browser session, combined with long-lived JWT tokens lacking HttpOnly protection and cross-tab access. The Direct Connections feature is disabled by default, limiting the attack surface to users who explicitly enable it.
Governance controls
Open WebUI version 0.6.35 and later block malicious execute events from Direct Connections. Researchers recommended moving authentication to short-lived and HttpOnly cookies with rotation, paired with strict Content Security Policy and a ban on dynamic code evaluation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.