the-knell/one-secondSigned whitepaper and measurement showing Open WebUI's Windows installer derives WEBUI_SECRET_KEY from a time-seeded rand(), enabling blind master key recovery and admin token forgery.
knell
Timestamp of record (archive.org): https://archive.org/details/knell-one-second
Open WebUI's Windows installer mints its master secret — WEBUI_SECRET_KEY, the key that signs every session token — from the Windows C library's rand(), a linear congruential generator seeded once with the current time in seconds. The whole key is the install second. From any ordinary user's own token, this paper recovers the master key blind in 2.1 seconds across a ±1-day window and forges a full administrator token, accepted by a local instance of the official release. Every one of the 178 release tags ships the construction. (CVE-2025-15603 was disputed and rejected in June 2026; this paper replaces that judgment with a measurement.)
gpg --import knell-public.asc
gpg --verify whitepaper-openwebui-FINAL-2026-11-04.md.asc
Expect: Good signature from "knell", key 133883AB9F6EDE5B9BA6B82E27BEDAF0CE152F25
Fingerprint: 1338 83AB 9F6E DE5B 9BA6 B82E 27BE DAF0 CE15 2F25