{"id":"CVE-2025-15603","state":"REJECTED","title":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Not","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: \"The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key).\"","publishedAt":"2026-03-09T20:32:06.017Z","updatedAt":"2026-06-18T05:47:57.489Z","severity":null,"assigner":"VulDB","products":[],"affected":[],"references":[],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/15xxx/CVE-2025-15603.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15603","state":"REJECTED","datePublished":"2026-03-09T20:32:06.017Z","dateUpdated":"2026-06-18T05:47:57.489Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-07T17:27:05.310Z","dateRejected":"2026-06-18T05:47:57.489Z"},"containers":{"cna":{"rejectedReasons":[{"lang":"en","value":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: \"The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key).\""}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-18T05:47:57.489Z"}}}}}