Librechat EUVD-2026-12092

LibreChat versions 0.8.2 to 0.8.2-rc3 with MCP OAuth callback endpoint enabled. Attacker requires valid LibreChat account (PR:L). Victim must complete authorization flow via shared link (UI:R). No verification of session ownership between initiator and token recipient.

The CVSS 7.6 (High) score reflects significant risk: network-based attack (AV:N), low complexity (AC:L), requires low privileges (PR:L) and user interaction (UI:R), with scope change (S:C) leading to high confidentiality impact (C:H). However, real-world risk is moderated by several factors: no KEV listing indicates no known active exploitation, no public POC exists, EPSS data is unavailable (likely due to recent disclosure), and the attack requires social engineering to trick victims into clicking malicious OAuth URLs. The SSVC framework would likely categorize this as 'Attend' priority - while automatable and with significant technical impact, exploitation requires user interaction and is not currently observed in the wild.

An attacker with a low-privileged LibreChat account initiates an OAuth flow with a target service (e.g., Atlassian Confluence), captures the authorization URL, and sends it to a victim via phishing email or message. When the unsuspecting victim clicks the link and completes authentication with their Atlassian credentials, the OAuth tokens are stored in the attacker's LibreChat account instead of the victim's. The attacker can then use these tokens to access the victim's Atlassian resources. No public POC exists, but the attack is straightforward given the CVSS low complexity rating.