LangChat REST API Controllers Missing Authentication
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
LangChat through commit 2a6285a does not require authentication on its REST API controllers because no Sa-Token interceptor is registered. An unauthenticated remote attacker can reach these controllers, read plaintext passwords and LLM provider API keys, create super-admin accounts, and modify or delete data. The weakness is classified as CWE-306, missing authentication for critical functionality.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for LangChat.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111704
- 2026-10-16 Alias added: GHSA-hgqj-chvw-c4p5
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: MEDIUM → HIGH
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Other 3
- https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33
- https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60
- https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/service/impl/AuthServiceImpl.java#L51-L58
Sources
- CVE-2026-111704 · CVE Program
- CVE-2026-111704 · NVD
- FIRST EPSS
- GHSA-hgqj-chvw-c4p5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences