PT-2026-6482 · Pypi · Chainlit

Published 2026-01-14 · Updated 2026-01-14

OSV

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

GHSA-V492-6XX2-P57G

Affected Products

Chainlit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-68492 · Security Note
• https://osv.dev/vulnerability/GHSA-v492-6xx2-p57g · Vendor Advisory
• https://github.com/Chainlit/chainlit/releases · Note
• https://github.com/Chainlit/chainlit · Note
• https://github.com/Chainlit/chainlit/pull/2637 · Note
• https://github.com/Chainlit/chainlit/releases/tag/2.8.5 · Note
• https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e · Note
• https://jvn.jp/en/jp/JVN34964581 · Note