CVE-2026-31944— LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link

LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

关键功能的认证机制缺失

LibreChat 访问控制错误漏洞

LibreChat是LibreChat开源的一个免费、高度可定制的统一 AI 对话平台，能够在一个界面中聚合并运行来自任意厂商的大模型。 LibreChat 0.8.2至0.8.2-rc3版本存在访问控制错误漏洞，该漏洞源于MCP OAuth回调端点未验证浏览器登录状态或用户匹配，可能导致账户接管。

N/A

N/A