A critical vulnerability (CVE-2025-64496) has been discovered in Open WebUI versions up to 0.6.34, posing significant security risks for organizations using the platform. This flaw allows attackers to exploit a weakness in the handling of Server-Sent Events (SSE) within the ‘Direct Connections’ feature. By connecting compromised AI model servers, attackers can inject malicious JavaScript code into the system.
The execution of this code is facilitated through insecure SSE handling, allowing attackers to steal JSON Web Tokens (JWT) from browser storage. With these tokens, attackers can initiate account takeovers, gaining unauthorized access to AI workspaces. If the compromised account has workspace.tools permissions, the attackers can escalate their access further to achieve remote code execution on backend servers.
This vulnerability was swiftly addressed in version 0.6.35 of Open WebUI, which implements measures that block the execution of malicious SSE events from Direct Connections. Organizations using Open WebUI are strongly advised to update to version 0.6.35 immediately to mitigate the risk of exploitation and maintain their security posture.

Collections

A critical vulnerability (CVE-2025-64496) in Open WebUI versions up to 0.6.34 allows attackers to inject malicious JavaScript through compromised AI model servers via insecure Server-Sent Events handling. Attackers can steal JWT tokens from browser storage to take over accounts and potentially achieve remote code execution on backend servers if the compromised account has workspace.tools permissions. The vulnerability has been patched in version 0.6.35, and immediate updates are strongly recommended.

Critical Vulnerability in Open WebUI Allows Security Breach through AI Model Servers