EUVD-2026-39457Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Network OAuth flow with no attacker privileges but requires an operator to add the malicious server (UI:R); token theft crosses to another server (S:C) breaching confidentiality and enabling integrity actions, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL, allowing a malicious MCP server to steal access tokens intended for a legitimate server. This vulnerability is fixed in 0.8.5.
AnalysisAI
Access-token theft in LibreChat before 0.8.5 lets a malicious MCP (Model Context Protocol) server hijack OAuth tokens minted for a legitimate server, because the client never checks that the RFC 9728 resource parameter matches the configured MCP server URL. Any LibreChat operator who connects their instance to an attacker-controlled MCP server can have the OAuth access tokens intended for a trusted server silently exfiltrated. SSVC rates technical impact as total and a proof-of-concept is referenced, but there is no public exploit weaponization and EPSS exploitation probability is very low (0.11%); it is fixed in 0.8.5.
Technical ContextAI
The flaw lives in LibreChat's MCP OAuth client flow. MCP servers advertise their authorization requirements via OAuth 2.0 Protected Resource Metadata (RFC 9728), which includes a 'resource' indicator identifying the audience the issued token is bound to. LibreChat failed to validate that this advertised resource value matched the MCP server URL the user actually configured, an instance of CWE-346 (Origin Validation Error). Because the audience/resource binding goes unverified, a rogue MCP server can present metadata pointing the OAuth dance at a legitimate server's resource, causing LibreChat to forward (or expose) tokens scoped for the trusted server to the attacker. The affected component is cpe:2.3:a:danny-avila:librechat across all versions prior to 0.8.5.
RemediationAI
Vendor-released patch: upgrade to LibreChat 0.8.5, which adds validation that the OAuth Protected Resource metadata 'resource' parameter matches the configured MCP server URL; see the advisory at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gvpj-vm2f-2m23. If you cannot upgrade immediately, the most effective compensating control is to disable or remove MCP server integrations that use OAuth, or restrict configured MCP servers to a vetted allowlist of trusted, operator-controlled endpoints only - the trade-off is loss of third-party MCP connectivity for users. Additionally, treat any OAuth tokens that may have been exposed to untrusted MCP servers as compromised and rotate/revoke them at the legitimate resource server. Avoid connecting LibreChat to MCP servers received from untrusted parties until patched.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of f
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /ap
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, lead
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), th
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this v
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltra
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today