Open WebUI on Windows: master key derived from the install second

What happened and what to do

The post by theknell, published on the oss-sec mailing list on 5 November 2026, claims that the Open WebUI Windows installer (start_windows.bat) generates WEBUI_SECRET_KEY, the secret that signs all session tokens, using the C library rand() function. The generator, a linear congruential type, is seeded once with the current time in seconds, so the whole entropy of the key would be the second of installation. According to the text, from an ordinary user's token the key could be recovered without prior information in about 2.1 seconds, within a window of ±1 day.

For a company running Open WebUI on Windows workstations, the risk is that anyone holding a valid token could derive the secret and forge sessions of other users. The practical response starts with an inventory: identify the Windows installations, check how and when the key was generated in each one, and replace it with a secret created from a cryptographically secure source, invalidating existing tokens. A controlled test in an isolated environment then helps confirm or rule out the claim in your context, along with a deployment process that generates secrets at deploy time and keeps them out of the installer and version-controlled files.

How the consultancy can help

Assessment of exposure across Open WebUI installations, including a Windows inventory and a review of how secrets are generated and stored; implementation of key rotation with session invalidation and a deployment process that creates secrets securely, operated in your own environment.

Next step

If your organization uses Open WebUI on Windows, send a short description of your setup, such as the number of installations and how they are deployed, and receive a scoped proposal with a diagnosis and remediation plan.