Vulnerability · Published Mar 13, 2026 · Assigned by GitHub_M
CVE-2026-31944LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
High 7.6
In plain English
A high-severity missing authentication in LibreChat from danny-avila. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| danny-avila | LibreChat | >= v0.8.2, <= 0.8.2-rc3 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
References
- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g x_refsource_CONFIRM