TI-2026-24490 Aliases CVE-2026-31944

LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link

HIGH 66CWE-306Published 2026-03-13 · Updated 2026-03-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0026 17th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
danny-avila	LibreChat	v0.8.2 – 0.8.2-rc3	—	No fix listed	CNA

LibreChat Vendordanny-avila Affected v0.8.2 – 0.8.2-rc3 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:librechat:librechat:0.8.2:-::::::	0.8.2	Vulnerable	danny-avila
cpe:2.3:a:librechat:librechat:0.8.2:rc1::::::	0.8.2 rc1	Vulnerable	danny-avila
cpe:2.3:a:librechat:librechat:0.8.2:rc2::::::	0.8.2 rc2	Vulnerable	danny-avila
cpe:2.3:a:librechat:librechat:0.8.2:rc3::::::	0.8.2 rc3	Vulnerable	danny-avila

cpe:2.3:a:librechat:librechat:0.8.2:-:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·danny-avila
cpe:2.3:a:librechat:librechat:0.8.2:rc1:*:*:*:*:*:* Versions 0.8.2 rc1 Vulnerable ·danny-avila
cpe:2.3:a:librechat:librechat:0.8.2:rc2:*:*:*:*:*:* Versions 0.8.2 rc2 Vulnerable ·danny-avila
cpe:2.3:a:librechat:librechat:0.8.2:rc3:*:*:*:*:*:* Versions 0.8.2 rc3 Vulnerable ·danny-avila

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-31944

References

Exploit 1

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g

TI-2026-25134 LibreChat Exfiltrates Server Secrets via MCP Server URL Injection CVSS 3.1CRITICAL 9.6
TI-2026-17862 LibreChat MCP Stdio Remote Command Execution CVSS 3.1CRITICAL 9.9
TI-2026-38976 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow CVSS 3.1CRITICAL 9.3
TI-2024-27763 LibreChat through 0.7.4-rc1 has incorrect access control for message updates. CVSS 3.1CRITICAL 9.8
TI-2024-10347 Path Traversal in danny-avila/librechat CVSS 3.0HIGH 8.8
TI-2026-25682 In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. CVSS 3.1CRITICAL 9.0

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences