CVE-2025-68492

MEDIUM
2026-01-14 [email protected] GHSA-v492-6xx2-p57g
4.2
CVSS 3.0
Share

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch Released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 14, 2026 - 07:16 nvd
MEDIUM 4.2

Tags

Authentication Bypass AI / ML

Description

Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

Analysis

Chainlit versions up to 2.8.5 is affected by authorization bypass through user-controlled key (CVSS 4.2).

Technical Context

This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects Chainlit. Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

Affected Products

Product: Chainlit. Versions: up to 2.8.5.

Remediation

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Priority Score

21
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +21
POC: 0

Share

CVE-2025-68492 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy