Cyber ·
Open WebUI on Windows: master key derived from the install second
A post on the oss-sec list claims the Open WebUI Windows installer generates WEBUI_SECRET_KEY from the time in seconds, making the key recoverable from an ordinary user token.
According to the advisory, machine-translated from a post on the oss-sec feed dated 5 November 2026, the Open WebUI start_windows.bat script generates WEBUI_SECRET_KEY, the secret that signs all session tokens, using the C library rand() function. This generator is a linear congruential one, seeded once with the current time in seconds, so according to the author the key's entire entropy would be the second of installation. The post claims that, starting from an ordinary user's token, the key can be recovered in about 2.1 seconds, within a window of ±1 day. These figures are the author's claims and have not been verified here. For anyone running Open WebUI on Windows, the practical point is to check whether the installation used this script, replace the key with a value produced by a cryptographically secure source, restart the service, and consider ending existing sessions. Rota Nacional does not install or maintain Open WebUI, and this advisory does not describe any flaw in Rota. Consult the original advisory and the project's fix notes before acting.