CVE-2026-31944

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31944", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.656Z", "datePublished": "2026-03-13T19:44:30.850Z", "dateUpdated": "2026-03-16T13:41:21.254Z"}, "containers": {"cna": {"title": "LibreChat MCP OAuth callback does not validate browser session \u2014 allows token theft via redirect link", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g"}], "affected": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"version": ">= v0.8.2, <= 0.8.2-rc3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:44:30.850Z"}, "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim\u2019s OAuth tokens are stored on the attacker\u2019s LibreChat account, enabling account takeover of the victim\u2019s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1."}], "source": {"advisory": "GHSA-vf7j-7mrx-hp7g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T13:40:08.924691Z", "id": "CVE-2026-31944", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:41:21.254Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31944", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T13:40:08.924691Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:41:15.558Z"}}], "cna": {"title": "LibreChat MCP OAuth callback does not validate browser session \u2014 allows token theft via redirect link", "source": {"advisory": "GHSA-vf7j-7mrx-hp7g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": ">= v0.8.2, <= 0.8.2-rc3"}]}], "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g", "name": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim\u2019s OAuth tokens are stored on the attacker\u2019s LibreChat account, enabling account takeover of the victim\u2019s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:44:30.850Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31944", "state": "PUBLISHED", "dateUpdated": "2026-03-16T13:41:21.254Z", "dateReserved": "2026-03-10T15:10:10.656Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T19:44:30.850Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "LibreChat", "vendor": "danny-avila", "versions": [{"status": "affected", "version": ">= v0.8.2, <= 0.8.2-rc3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.8.2:-:*:*:*:*:*:*", "matchCriteriaId": "8D828ED6-3F44-4DD1-B29F-62D8977AF33A", "vulnerable": true}, {"criteria": "cpe:2.3:a:librechat:librechat:0.8.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "8E26DE8F-E11A-4052-B9FE-59AD6B9AFD03", "vulnerable": true}, {"criteria": "cpe:2.3:a:librechat:librechat:0.8.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "21865C8B-C628-4275-A552-89F64EF22918", "vulnerable": true}, {"criteria": "cpe:2.3:a:librechat:librechat:0.8.2:rc3:*:*:*:*:*:*", "matchCriteriaId": "47A1B487-1A7B-4E06-8503-56E7D349FAA2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim\u2019s OAuth tokens are stored on the attacker\u2019s LibreChat account, enabling account takeover of the victim\u2019s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1."}, {"lang": "es", "value": "LibreChat es un clon de ChatGPT con caracter\u00edsticas adicionales. Desde 0.8.2 hasta 0.8.2-rc3, el endpoint de callback OAuth de MCP (Model Context Protocol) acepta la redirecci\u00f3n del proveedor de identidad y almacena tokens OAuth para el usuario que inici\u00f3 el flujo, sin verificar que el navegador que accede a la URL de redirecci\u00f3n est\u00e9 logueado o que el usuario logueado coincida con el iniciador. Un atacante puede enviar la URL de autorizaci\u00f3n a una v\u00edctima; cuando la v\u00edctima completa el flujo, los tokens OAuth de la v\u00edctima se almacenan en la cuenta de LibreChat del atacante, permitiendo la toma de control de la cuenta de los servicios vinculados a MCP de la v\u00edctima (p. ej., Atlassian, Outlook). Esta vulnerabilidad se corrige en 0.8.3-rc1."}], "id": "CVE-2026-31944", "lastModified": "2026-06-17T10:34:49.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31944", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T13:40:08.924691Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:39.590", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.8.2,0.8.2-rc3]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "LibreChat", "source": "cna", "vendor": "danny-avila"}, "product": "libre_chat", "vendor": "danny-avila"}], "analysis": {"en": {"generated_at": "2026-03-17T13:51:21.200694+00:00", "value": {"mitigation_remediation": ["Upgrade LibreChat to version 0.8.3\u2011rc1 or later to enforce proper session validation in the OAuth callback."], "summary": {"action": "Immediate Patch", "impact": "Token theft leading to account takeover via OAuth credentials"}, "threat_synthesis": {"affected_systems": "CVE\u20112026\u201131944 affects LibreChat versions from 0.8.2 through 0.8.2\u2011rc3 inclusive, as indicated by the affected CPEs for 0.8.2, rc1, rc2, and rc3. Updated builds beginning with 0.8.3\u2011rc1 contain the fix that restores proper session validation.", "description_and_impact": "LibreChat\u2019s MCP OAuth callback endpoint was found to accept and store access tokens without verifying that the browser initiating the callback is logged in or that the logged\u2011in user matches the flow\u2019s initiator. As a result, an attacker can trick a victim into completing an OAuth flow to that attacker\u2019s instance, resulting in the victim\u2019s OAuth tokens being associated with the attacker\u2019s LibreChat account. Once these tokens are stored, the attacker can access all MCP\u2011linked services for the victim (e.g., Atlassian, Outlook), effectively achieving an account takeover. The weakness is a missing authentication check for a critical operation (CWE\u2011306).", "risk_and_exploitability": "With a CVSS score of 7.6, the vulnerability is considered high severity. The EPSS score is less than 1%, indicating a low probability of being actively exploited in the wild, and it is not listed in the CISA KEV catalog. Likely exploitation requires the attacker to lure a victim into completing an OAuth flow on the attacker\u2019s LibreChat instance, which is achievable via phishing or malicious links. The attack path is remote and does not require local system compromise, relying solely on the victim\u2019s interaction with the redirect URL."}}}}, "created": "2026-03-16T09:24:10.568250+00:00", "updated": "2026-03-23T13:40:08.740525+00:00", "vendors": ["danny-avila", "danny-avila$PRODUCT$libre_chat"]}