Open WebUI’s realtime endpoints – such as Socket.IO connect, user‑join, join‑channels, join‑note, and the terminal websocket – previously used a token decoding routine that omitted the Redis‑backed revocation check. As a result, JWTs that had been revoked during signout or backchannel logout could still be accepted, allowing an attacker to authenticate with a token that should no longer be valid. This flaw could enable unauthorized users to maintain persistent websocket connections and access privileged real‑time data, effectively hijacking sessions in the absence of proper token invalidation. This failure corresponds to CWE‑613, the absence of appropriate security checks after authentication.

The vulnerability affects open‑webui versions 0.9.0 through just before 0.10.0 when Redis is configured as the authentication backend. Only deployments that enable Redis‑based authentication for realtime channels are impacted. The issue is fixed in release 0.10.0.

The CVSS score of 7.1 indicates a high severity that combines confidentiality, integrity, and availability impacts, and the EPSS score of < 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation is not yet confirmed. Nevertheless, the flaw is remotely exploitable via a revoked but still‑present JWT maintaining an authenticated session until the revocation takes effect.