What is the CVSS score of CVE-2026-31944?

CVE-2026-31944 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-31944?

LibreChat versions 0.8.2 through 0.8.2-rc3 contain an authentication bypass vulnerability that could allow attackers to steal OAuth tokens and compromise accounts linked to external services such as…

How to fix or mitigate CVE-2026-31944?

Within 24 hours: Identify all LibreChat instances running versions 0.8.2 through 0.8.2-rc3 and document their usage scope and connected OAuth services. Within 7 days: Disable the MCP OAuth callback endpoint or restrict access via network controls if feasible; communicate security advisory to all LibreChat users warning against completing unexpected OAuth authorization prompts. Within 30 days: Upgrade to a patched LibreChat version when available, or migrate to an alternative solution if patches are not released within reasonable timeframe; conduct user security awareness training on OAuth phishing and token theft risks.

AI / ML CVE-2026-31944

EUVD-2026-12092 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-13 GitHub_M

Atlassian Authentication Bypass Microsoft AI / ML Librechat

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-12092

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:44 nvd

HIGH 7.6

DescriptionGitHub Advisory

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.

AnalysisAI

LibreChat versions 0.8.2 through 0.8.2-rc3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) OAuth callback endpoint that allows attackers to steal OAuth tokens by tricking victims into completing an OAuth flow, resulting in account takeover of the victim's MCP-linked services like Atlassian and Outlook. No active exploitation is known (not in KEV), no POC is publicly available, and EPSS data is not yet available for this newly disclosed vulnerability.

Technical ContextAI

LibreChat (CPE: cpe:2.3:a:danny-avila:librechat:*:*:*:*:*:*:*:*) is an open-source ChatGPT clone that implements Model Context Protocol (MCP) for integrating with external services via OAuth. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function) where the OAuth callback endpoint fails to verify that the browser completing the OAuth flow belongs to the same user who initiated it. When integrating with services like Microsoft Outlook or Atlassian products, the OAuth tokens received from these identity providers are stored without proper session validation, allowing cross-user token injection.

RemediationAI

Upgrade to LibreChat version 0.8.3-rc1 or later, which contains the fix for this vulnerability. The vendor security advisory is available at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-vf7j-7mrx-hp7g. As a temporary workaround, administrators could disable MCP OAuth integrations until patching is complete. Organizations should also review OAuth token storage for any signs of unauthorized tokens that may have been injected before patching.