Librechat EUVD-2025-208825

The CVSS score of 8.0 (High) reflects the vulnerability's significant impact with adjacent network attack vector (AV:A), low complexity (AC:L), and requiring only low privileges (PR:L). The attack enables high confidentiality, integrity, and availability impact (C:H/I:H/A:H) without user interaction. However, real-world risk is tempered by several factors: the attack requires adjacent network access and authenticated user credentials, limiting the attack surface compared to remote unauthenticated exploits. The vulnerability affects a specific release candidate version (0.8.1-rc2) rather than a stable production release, potentially reducing the number of deployed instances. While the technical impact is severe for affected installations allowing lateral movement from user sessions to RAG API access, the adjacent network requirement and authentication prerequisite make this less immediately critical than remotely exploitable unauthenticated vulnerabilities, though it remains a serious concern for multi-tenant or shared hosting environments.

An authenticated user with low-privilege access to LibreChat on an adjacent network obtains their own session JWT token through normal authentication. By analyzing the token structure and reusing the same JWT secret that signs both user sessions and RAG API requests, the attacker crafts or repurposes their session token to authenticate directly to the RAG API endpoints, bypassing service-level access controls. This allows the attacker to read sensitive RAG data, modify retrieval configurations, or disrupt the RAG service availability, potentially accessing other users' context data or poisoning the knowledge base used for AI-augmented responses across the application.