PT-2026-26053 · Danny Avila · Librechat

Lisa Gnedt + 1 · Published 2026-03-18 · Updated 2026-03-18 · CVE-2025-41258

Mitre

CVSS v3.1

8.0

High

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-41258

Affected Products

Librechat

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-41258 · Security Note
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01_LibreChat_RAG_API_Authentication_Bypass · Note
• https://github.com/danny-avila/LibreChat · Note