What’s Vulnerable › Vulnerabilities
CVE-2026-31944: LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
- Severity: high (CVSS 7.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-13 · updated 2026-06-17
- Weakness: CWE-306
Description
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.
Affected products
- danny-avila LibreChat: 0.8.2, 0.8.2-rc1, 0.8.2-rc2, 0.8.2-rc3
References
Get alerted when CVE-2026-31944 or the next vulnerability affects your stack