What is the CVSS score of CVE-2026-31950?

CVE-2026-31950 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Librechat are affected by CVE-2026-31950?

Organizations using versions 0.8.2-rc2 should be aware of moderate risk from CVE-2026-31950, a improper access control vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-31950?

Within 30 days: Identify affected systems running versions 0.8.2-rc2 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Librechat CVE-2026-31950

EUVD-2026-16767 MEDIUM

Improper Access Control (CWE-284)

2026-03-27 GitHub_M

Authentication Bypass Librechat

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.8.2

EUVD ID Assigned

Mar 27, 2026 - 19:45 euvd

EUVD-2026-16767

Analysis Generated

Mar 27, 2026 - 19:45 vuln.today

CVE Published

Mar 27, 2026 - 19:25 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint /api/agents/chat/stream/:streamId does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and read another user's real-time chat content, including messages, AI responses, and tool invocations. Version 0.8.2 patches the issue.

AnalysisAI

Unauthenticated stream hijacking in LibreChat versions 0.8.2-rc2 through 0.8.2-rc3 allows authenticated users to read other users' real-time chat conversations via the SSE streaming endpoint /api/agents/chat/stream/:streamId without ownership verification. An attacker with valid credentials can enumerate or guess stream IDs to intercept sensitive messages, AI-generated responses, and tool invocation data from arbitrary users. The vulnerability was patched in version 0.8.2.

Technical ContextAI

LibreChat implements Server-Sent Events (SSE) streaming for real-time chat delivery via the /api/agents/chat/stream/:streamId endpoint. The vulnerability stems from a missing authorization check (CWE-284: Improper Access Control) that fails to validate whether the authenticated user owns or has permission to subscribe to the requested stream resource. The endpoint accepts a stream ID parameter in the URL path but does not cross-reference it against the authenticated user's session or user ID before establishing the SSE connection. This design flaw allows any authenticated user to construct a request with a stream ID belonging to another user and receive their chat data in real-time. The affected product is LibreChat (CPE: cpe:2.3:a:danny-avila:librechat:*:*:*:*:*:*:*:*), an open-source ChatGPT alternative built with Node.js and web technologies.

RemediationAI

Vendor-released patch: LibreChat version 0.8.2 and later. Upgrade from 0.8.2-rc2 or 0.8.2-rc3 to the stable 0.8.2 release or any later version. The patch implements owner verification on the /api/agents/chat/stream/:streamId endpoint to ensure only the authenticated user who initiated the stream can subscribe to its SSE output. Reference the GitHub security advisory GHSA-f6rf-vm44-wh5g at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-f6rf-vm44-wh5g for detailed guidance and confirmation. If immediate upgrade is not feasible, isolate affected instances from untrusted network access or restrict user account creation to trusted parties to limit the attack surface.