CVE-2025-63391
| CVE ID | CVE-2025-63391 |
| Vendor Disposition | Rejected, mischaracterized |
| Published | 2025-12-18 |
| Issuing CNA | MITRE, from a public disclosure (CVSS enrichment contributed by CISA-ADP) |
| Claimed Severity | High (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) |
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
| Date | Event |
|---|---|
| 2025-12-18 | CVE-2025-63391 published by MITRE, derived from a public disclosure (CVSS enrichment contributed by CISA-ADP). |
| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program. The dispute goes unanswered. |
| 2026-05-05 | Open WebUI publishes this disposition, rejecting the report as mischaracterized. |
| 2026-06-13 | Open WebUI files a dispute with NVD; NVD declines to adjudicate and directs the dispute to the CVE Program. |
| 2026-06-15 | Open WebUI files another dispute with the CVE Program; MITRE, as the issuing CNA, reaches out to the original researcher. |
| 2026-06-29 | The issuing CNA withdraws the record. The official CVE record state becomes REJECTED. |
Our disposition rejected this report on 2026-05-05. The issuing CNA followed later: on 2026-06-29 the record was formally withdrawn, so the official CVE record now carries the REJECTED state, which NVD and downstream feeds inherit. The public record now matches the position we had already taken, and there is no advisory or affected Open WebUI release. The CNA's published rejection reads:
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
The /api/config endpoint in Open WebUI ≤0.6.32 allegedly lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers.
Why This Is Not a Vulnerability
The /api/config endpoint is, by design, accessible to unauthenticated callers. It serves the small set of public information required by Open WebUI's front-end before a user is authenticated, namely the application name, locale, version, list of enabled OAuth provider names (without secrets), and feature flags such as enable_signup and enable_ldap that the login UI must read in order to render correctly. This is analogous to a /.well-known/ discovery document or a /api/v1/info endpoint that many web applications expose without authentication for client bootstrapping.
Sensitive Fields Are Properly Gated
The endpoint contains an explicit role-gated branch in its response handler. Sensitive fields, including but not limited to OAuth client identifiers and secrets, Google Drive credentials, OneDrive credentials, SharePoint configuration, default model identifiers, pinned models, and user counts, are returned only when the request carries a valid authenticated session for an admin or user role. The relevant conditional in the codebase is if user is not None and (user.role in ['admin', 'user']). Sensitive fields are not returned to unauthenticated callers under any code path.
CWE-306 Is Incorrectly Applied
The CWE-306 ("Missing Authentication for Critical Function") characterization is incorrect on two grounds:
- The endpoint is not a "critical function." It is a public discovery endpoint returning client-bootstrap information.
- The endpoint does not "miss" authentication. It is intentionally unauthenticated for bootstrap data, with sensitive fields properly gated behind authentication via the role check.
Applicable Security Policy Rules
- Rule 7: The report mischaracterizes a deliberately public discovery endpoint as an authentication-bypass vulnerability.
- Rule 1: Expected protocol behavior is not a vulnerability.
Impact to Users
No action required. The /api/config endpoint returns only public bootstrap information to unauthenticated callers. Sensitive configuration fields are gated behind authentication and are not exposed.