This vulnerability arises when Open WebUI transmits credentials in cleartext to the exposed endpoint. An attacker who can observe traffic on the same network segment can capture those credentials without requiring authentication, potentially enabling further compromise of the target system.

The affected product is Open WebUI version 0.6.32. No other versions were explicitly listed in the CNA data.

The CVSS score of 6.5 reflects a moderate severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑adjacent attacker who can sniff traffic to the vulnerable endpoint; no credentials are needed to trigger the disclosure.