PT-2026-25366 · Danny Avila+2 · Librechat

Danny-Avilapublished · Published 2026-03-13 · Updated 2026-03-18 · CVE-2026-31944

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreChat versions 0.8.2 through 0.8.2-rc3

Description LibreChat is a ChatGPT clone with additional features. The MCP (Model Context Protocol) OAuth callback endpoint does not verify that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. This allows an attacker to obtain a victim’s OAuth tokens after sending them an authorization URL, leading to account takeover of the victim’s MCP-linked services, such as Atlassian and Outlook. The issue is a confused deputy problem.

Recommendations Update to version 0.8.3-rc1 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-31944

GHSA-VF7J-7MRX-HP7G

Affected Products

Librechat

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31944.json · Exploit
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31944 · Security Note
• https://twitter.com/natalie_avfieb/status/2032730275906728191 · Twitter Post
• https://twitter.com/Prateektomar/status/2034125290373628390 · Twitter Post
• https://twitter.com/Prateektomar/status/2033038068257845535 · Twitter Post
• https://twitter.com/CVEnew/status/2032605882433867903 · Twitter Post