Librechat EUVD-2026-16769

The CVSS 6.8 (Medium) score reflects a networked, low-complexity attack requiring low privileges and user interaction, with high confidentiality impact but no integrity or availability impact. However, real-world risk is moderated by several factors: the attack requires an authenticated user (PR:L), necessitates user action to interact with a malicious MCP server (UI:R), and affects only pre-release versions (0.8.2-rc1 through 0.8.3-rc1). EPSS data is not provided, and no public exploit code or active CISA KEV listing exists, indicating this remains a theoretical risk despite the potentially severe consequence of OAuth token theft. The user-interaction requirement and requirement for victims to explicitly use an attacker's MCP server limit the attack surface in practice. Organizations using LibreChat in production should prioritize upgrading, but pre-release deployments are less common in enterprise environments.

An attacker creates a malicious MCP server definition with HTTP headers containing {{LIBRECHAT_OPENID_ACCESS_TOKEN}} and tricks an authenticated LibreChat user into invoking a tool on that server (e.g., via social engineering or a shared configuration). When the user executes the tool, LibreChat automatically substitutes the placeholder with the victim's actual OAuth token and sends it in the HTTP header to the attacker's server, exposing the credential. The attacker can then use the stolen token to impersonate the victim in connected OAuth-secured services.