Posted by theknell--- via Fulldisclosure on Nov 12 Open WebUI's Windows installer (start_windows.bat) generates WEBUI_SECRET_KEY — the master secret that signs every session token — from the C library's rand(), a linear congruential generator seeded once with the current time in seconds. The key's entire entropy is the second in which the software was installed. From any ordinary user's own token, the master key is recoverable blind in ~2.1 seconds across a ±1-day...