Open WebUI’s realtime endpoints—including Socket.IO connect, user‑join, join‑channels, join‑note, and the terminal websocket first‑message authentication—have historically decoded JWTs without consulting the Redis‑backed token validity store. As a result, a JWT that had been revoked during signout or backchannel logout could still be accepted. This flaw corresponds to CWE‑613, the absence of appropriate security checks after authentication. Based on the description, an attacker could maintain malicious websocket connections and persistently access privileged real‑time data, effectively hijacking sessions.

Versions of Open WebUI from 0.9.0 up to, but not including, 0.10.0 are impacted when Redis is configured as the authentication backend for realtime channels. Deployments that enable Redis‑based authentication for Socket.IO and terminal connections are vulnerable. The issue is fixed in release 0.10.0.

The CVSS score of 7.1 indicates high severity with combined confidentiality, integrity and availability implications. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability has not yet been reported in the CISA KEV catalog, implying that public exploitation is not confirmed. Nonetheless, remote exploitation is possible by supplying a revoked but still‑valid JWT to a realtime endpoint, allowing continued authenticated activity until the revocation takes effect.