Missing Authentication for Critical Function in LibreChat - CVE-2026-31944
Published: April 27, 2026
Vulnerability identifier: #VU128103
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-31944
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to steal OAuth tokens and gain unauthorized access to MCP-linked services.
The vulnerability exists due to improper authentication and session validation in the GET /:serverName/oauth/callback endpoint in api/server/routes/mcp.js when processing an OAuth callback redirect. A remote user can send a crafted authorization URL to a victim to steal OAuth tokens and gain unauthorized access to MCP-linked services.
User interaction is required to open the authorization URL, and the issue affects deployments where MCP OAuth is enabled for an integration.
Affected software
LibreChat
How to mitigate CVE-2026-31944
Install security update from vendor's website.
LibreChat - update to 0.8.3 rc1